Description
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Published: 2026-10-28
Score: 6.8 Medium
EPSS: n/a
KEV: No
Impact: Information disclosure via path traversal
Action: Apply patch
AI Analysis

Impact

A path traversal flaw exists in Dell PowerProtect Data Domain that allows a high‑privileged attacker with remote access to resolve file paths outside the intended directory, potentially exposing sensitive data. The vulnerability is identified as an Improper Limitation of a Pathname to a Restricted Directory.

Affected Systems

Dell PowerProtect Data Domain feature releases 7.7.1.0 through 8.8, LTS2025 release versions 8.3.1.0 through 8.3.1.40, and LTS2026 release versions 8.6.1.0 through 8.6.1.20 are impacted.

Risk and Exploitability

The CVSS score is 6.8, indicating a moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The vulnerability is exploitable only by attackers who already have high‑privilege remote access, which limits the attack surface but still poses a significant risk because it can lead to disclosure of confidential information.

Generated by OpenCVE AI on October 28, 2026 at 11:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Install Dell security update DSA-2026-416 for PowerProtect Data Domain (link: https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities)
  • Upgrade to a supported release version that contains the fix (e.g., 8.8 or newer LTS releases beyond 8.3.1.40 and 8.6.1.20).
  • Restrict remote privileged access and enforce least‑privilege policies to reduce the likelihood that an attacker can obtain the required credentials.

Generated by OpenCVE AI on October 28, 2026 at 11:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain Path Traversal Vulnerability Leading to Information Disclosure

Wed, 28 Oct 2026 10:00:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-10-28T09:54:54.400Z

Reserved: 2026-09-07T10:04:28.183Z

Link: CVE-2026-86383

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T10:17:09.297

Modified: 2026-10-28T10:17:09.297

Link: CVE-2026-86383

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T11:30:11Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')