Dell PowerProtect Data Domain: seven critical flaws (CVE-2026-103780, CVE-2026-90717) fixed by Dell
CVE-2026-103780 CVE-2026-103792 CVE-2026-103799 CVE-2026-86384 CVE-2026-86397 CVE-2026-86400 CVE-2026-90717
Published 01/11/2026 02:14
Timeline
2 events over 2 d 16 h
- 29/10/2026 10:05ConfirmedBSI CERT-Bund (WID)+2 d 16 h
- 01/11/2026 02:14Published on WatchtowerPro CISO
In short
Dell has fixed several critical flaws in PowerProtect Data Domain and Data Domain Management Center, according to the Dutch NCSC. Four flaws in Data Domain (CVSS 9.8) can be abused remotely without logging in. Three flaws in Management Center (CVSS 9.1 to 9.6) need a low-privileged account. Check Dell's advisory and install the fixed versions.
How bad is it
Critical: an unauthenticated remote attacker can run commands or take over Data Domain systems; the Management Center flaws need a low-privileged account.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 7 CVEs · CVSS 3.1 from NVD, from emc.com, read 01/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Dell PowerProtect Data Domain versions 7.7.1.0 through 8.x are listed for the separate flaw CVE-2026-54483; this has not been tied to the seven reported CVEs.
What to do now
- Open Dell's advisory directly on dell.com/support and check whether DSA-2026-278 or a separate advisory applies to your Data Domain systems.
- Install the fixed versions once Dell confirms them for your branch.
- Check each of the seven CVE IDs on NVD and in EUVD, and check CISA KEV and CERT-EU for exploitation reports.
- Until a fix is confirmed, make sure management interfaces are not reachable from the internet and limit management access to a dedicated admin network. These measures reduce exposure and do not make a system safe.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer and all 5 sources with their dates. And technology matching: which of your systems run Dell PowerProtect Data Domain OS, at which version, fixed or not - and what each one needs.
Main sources
[NEU] [hoch] Dell PowerProtect Data Domain OS: Mehrere Schwachstellen CERT · [UPDATE] [hoch] Dell PowerProtect Data Domain: Mehrere Schwachstellen CERT · NCSC-2026-0460 [1.00] [M/H] Kwetsbaarheden verholpen in Dell PowerProtect Data Domain CERT