Description
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
Published: 2026-10-27
Score: 5.8 Medium
EPSS: n/a
KEV: No
Impact: Server-side request forgery
Action: Apply Patch
AI Analysis

Impact

The vulnerability is a server-side request forgery that can be triggered by an unauthenticated attacker who has remote access. The flaw enables the attacker to instruct the PowerProtect appliance to make arbitrary internal or external HTTP requests, potentially exposing sensitive data or internal network resources. The weakness is classified as CWE-918.

Affected Systems

This issue affects Dell PowerProtect Data Domain appliances that are running any of the following release ranges: Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20.

Risk and Exploitability

With a CVSS score of 5.8, the vulnerability carries a moderate risk level. The EPSS score is not available and the flaw is currently not listed in the CISA KEV catalog, indicating that no widespread exploitation has been reported to date. Nonetheless, the attack vector is remote and unauthenticated, which limits the attack surface but still permits attackers to force the appliance to transmit requests to arbitrary endpoints, potentially leading to data leakage or further network compromise.

Generated by OpenCVE AI on October 27, 2026 at 12:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Dell Security Update Package DSA-2026-416 to upgrade PowerProtect Data Domain to a version that contains the SSRF fix.
  • Restrict outbound network connections from the appliance using firewalls or ACLs to limit potential SSRF exploitation.
  • Review and enforce authentication mechanisms on exposed services to ensure only authorized clients can invoke internal requests.

Generated by OpenCVE AI on October 27, 2026 at 12:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Domain
Vendors & Products Dell
Dell powerprotect Data Domain

Tue, 27 Oct 2026 12:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated SSRF in Dell PowerProtect Data Domain

Tue, 27 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'}

Subscriptions

Dell Powerprotect Data Domain
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-10-27T11:15:06.091Z

Reserved: 2026-06-18T17:04:56.015Z

Link: CVE-2026-56084

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-27T12:17:08.187

Modified: 2026-10-27T14:58:57.680

Link: CVE-2026-56084

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T13:15:02Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)