{ "document": { "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "nl", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." }, { "category": "description", "text": "Dell heeft meerdere kritieke kwetsbaarheden verholpen in PowerProtect Data Domain, Data Domain Virtual Edition en Data Domain Management Center.", "title": "Feiten" }, { "category": "description", "text": "De kritieke wetsbaarheden met kenmerk CVE-2026-103780, CVE-2026-86384, CVE-2026-86397 en CVE-2026-86400 in Dell PowerProtect Data Domain, hebben een CVSS-score van 9.8. Een niet-geauthenticeerde kwaadwillende kan deze kwetsbaarheden op afstand misbruiken om willekeurige opdrachten uit te voeren, inloggegevens te verkrijgen of accounts met verhoogde rechten aan te maken. \n\nDaarnaast heeft Dell drie kritieke kwetsbaarheden verholpen in Data Domain Management Center. De kwetsbaarheden met kenmerken CVE-2026-103799 en CVE-2026-103792 hebben een CVSS-score van 9.6 en CVE-2026-90717 heeft een CVSS-score van 9.1. Een kwaadwillende met beperkte gebruikersrechten kan deze kwetsbaarheden op afstand misbruiken om ongeautoriseerde toegang tot beheerde systemen te verkrijgen, handelingen uit te voeren of verhoogde rechten te verkrijgen.\n\nDell heeft ook verschillende andere kwetsbaarheden verholpen. Misbruik hiervan kan onder andere leiden tot het uitvoeren van willekeurige opdrachten, het verkrijgen van verhoogde rechten, ongeautoriseerde toegang tot gegevens en verstoring van de dienstverlening.", "title": "Interpretaties" }, { "category": "description", "text": "Dell heeft updates uitgebracht om de kwetsbaarheden te verhelpen. De kwetsbaarheden zijn verholpen in DD OS 8.9.0.0, 7.13.1.90 (LTS2024), 8.3.1.50 (LTS2025) en 8.6.1.30 (LTS2026), of latere versies binnen de betreffende releasebranches. Zie bijgevoegde referenties voor meer informatie.", "title": "Oplossingen" }, { "category": "general", "text": "medium", "title": "Kans" }, { "category": "general", "text": "high", "title": "Schade" }, { "category": "general", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "general", "text": "Relative Path Traversal", "title": "CWE-23" }, { "category": "general", "text": "Path Traversal: '..\\filedir'", "title": "CWE-28" }, { "category": "general", "text": "Path Traversal: 'dir\\..\\..\\filename'", "title": "CWE-31" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "general", "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "title": "CWE-89" }, { "category": "general", "text": "Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "title": "CWE-120" }, { "category": "general", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "general", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "general", "text": "Improper Check for Dropped Privileges", "title": "CWE-273" }, { "category": "general", "text": "Authentication Bypass by Spoofing", "title": "CWE-290" }, { "category": "general", "text": "Missing Authentication for Critical Function", "title": "CWE-306" }, { "category": "general", "text": "Use of Hard-coded Cryptographic Key", "title": "CWE-321" }, { "category": "general", "text": "Improper Validation of Integrity Check Value", "title": "CWE-354" }, { "category": "general", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "general", "text": "Missing Authorization", "title": "CWE-862" } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "Nationaal Cyber Security Centrum", "namespace": "https://www.ncsc.nl/" }, "references": [ { "category": "external", "summary": "Reference", "url": "https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities" } ], "title": "Kwetsbaarheden verholpen in Dell PowerProtect Data Domain", "tracking": { "current_release_date": "2026-10-30T09:10:19.353296Z", "generator": { "date": "2025-08-04T16:30:00Z", "engine": { "name": "V.A.", "version": "1.3" } }, "id": "NCSC-2026-0460", "initial_release_date": "2026-10-30T09:10:19.353296Z", "revision_history": [ { "date": "2026-10-30T09:10:19.353296Z", "number": "1.0.0", "summary": "Initiele versie" } ], "status": "final", "version": "1.0.0" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-1" } } ], "category": "product_name", "name": "PowerProtect Data Domain" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-2" } } ], "category": "product_name", "name": "PowerProtect Data Domain Management Center" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/*", "product": { "name": "vers:unknown/*", "product_id": "CSAFPID-3" } } ], "category": "product_name", "name": "PowerProtect Data Domain Virtual Edition" } ], "category": "vendor", "name": "Dell" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-68866", "cwe": { "id": "CWE-23", "name": "Relative Path Traversal" }, "notes": [ { "category": "other", "text": "Relative Path Traversal", "title": "CWE-23" }, { "category": "description", "text": "PowerProtect Data Domain versions 7.7.1.0 through 8.7 and LTS2024-2026 releases have a Relative Path Traversal vulnerability in the certificate that can enable a high privileged remote attacker to cause a Denial of Service.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-68866 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-68866.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-68866" }, { "cve": "CVE-2026-86377", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "other", "text": "Out-of-bounds Write", "title": "CWE-787" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have an Out-of-bounds Write vulnerability enabling a low privileged remote attacker to cause Denial of Service.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86377 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86377.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H", "baseScore": 7.6, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86377" }, { "cve": "CVE-2026-86378", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain a stack-based buffer overflow vulnerability enabling low privileged remote attackers to gain unauthorized access.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86378 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86378.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86378" }, { "cve": "CVE-2026-86379", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and select LTS releases contain a high-severity OS command injection vulnerability enabling remote attackers with high privileges to execute arbitrary commands.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86379 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86379.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86379" }, { "cve": "CVE-2026-86380", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have an Integer Overflow vulnerability enabling high privileged remote attackers to bypass protection mechanisms.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86380 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86380.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86380" }, { "cve": "CVE-2026-86383", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including certain LTS2025 and LTS2026 releases, contain a path traversal vulnerability enabling a high privileged remote attacker to cause information disclosure.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86383 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86383.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86383" }, { "cve": "CVE-2026-86384", "cwe": { "id": "CWE-321", "name": "Use of Hard-coded Cryptographic Key" }, "notes": [ { "category": "other", "text": "Use of Hard-coded Cryptographic Key", "title": "CWE-321" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024-2026 releases have a vulnerability involving hard-coded cryptographic keys that may allow unauthenticated remote attackers to expose credentials and gain privileged access.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86384 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86384.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86384" }, { "cve": "CVE-2026-86385", "cwe": { "id": "CWE-273", "name": "Improper Check for Dropped Privileges" }, "notes": [ { "category": "other", "text": "Improper Check for Dropped Privileges", "title": "CWE-273" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 contain a vulnerability that permits a low privileged remote attacker to potentially escalate privileges due to improper privilege drop verification.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86385 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86385.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86385" }, { "cve": "CVE-2026-86389", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "other", "text": "Integer Overflow or Wraparound", "title": "CWE-190" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have an Integer Overflow vulnerability enabling high privileged remote code execution.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86389 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86389.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86389" }, { "cve": "CVE-2026-86390", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have a Missing Authorization vulnerability allowing low privileged remote attackers unauthorized access.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86390 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86390.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86390" }, { "cve": "CVE-2026-86391", "cwe": { "id": "CWE-290", "name": "Authentication Bypass by Spoofing" }, "notes": [ { "category": "other", "text": "Authentication Bypass by Spoofing", "title": "CWE-290" }, { "category": "description", "text": "Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain an authentication bypass by spoofing vulnerability enabling low privileged remote attackers to cause denial of service.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86391 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86391.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L", "baseScore": 6.4, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86391" }, { "cve": "CVE-2026-86393", "notes": [ { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have an Improper Privilege Management vulnerability enabling high privileged remote attackers to escalate privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86393 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86393.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86393" }, { "cve": "CVE-2026-86394", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have an OS Command Injection vulnerability allowing high privileged remote attackers to execute arbitrary commands.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86394 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86394.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86394" }, { "cve": "CVE-2026-86395", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "Dell PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have a high-severity OS Command Injection vulnerability enabling high privileged remote attackers to execute arbitrary commands.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86395 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86395.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86395" }, { "cve": "CVE-2026-86396", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have an OS Command Injection vulnerability allowing low privileged remote attackers to execute arbitrary commands.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86396 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86396.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86396" }, { "cve": "CVE-2026-86397", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024-2026 releases have a critical Improper Authentication vulnerability enabling unauthenticated remote attackers to create privileged accounts and gain full system control.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86397 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86397.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86397" }, { "cve": "CVE-2026-86398", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "notes": [ { "category": "other", "text": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "title": "CWE-22" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have a path traversal vulnerability enabling low privileged remote attackers to gain unauthorized filesystem access.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86398 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86398.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86398" }, { "cve": "CVE-2026-86399", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have an OS Command Injection vulnerability allowing high privileged remote attackers to execute arbitrary commands.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86399 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86399.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86399" }, { "cve": "CVE-2026-86400", "notes": [ { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have a critical Improper Authentication vulnerability enabling unauthenticated remote attackers to execute arbitrary commands with root privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-86400 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86400.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-86400" }, { "cve": "CVE-2026-90717", "cwe": { "id": "CWE-290", "name": "Authentication Bypass by Spoofing" }, "notes": [ { "category": "other", "text": "Authentication Bypass by Spoofing", "title": "CWE-290" }, { "category": "description", "text": "Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and various LTS releases have an authentication bypass vulnerability enabling low-privileged remote attackers to escalate privileges and affect other managed Data Domain systems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-90717 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90717.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-90717" }, { "cve": "CVE-2026-90718", "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-90718 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90718.json" } ], "title": "CVE-2026-90718" }, { "cve": "CVE-2026-90720", "cwe": { "id": "CWE-354", "name": "Improper Validation of Integrity Check Value" }, "notes": [ { "category": "other", "text": "Improper Validation of Integrity Check Value", "title": "CWE-354" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain a vulnerability in integrity check validation that allows a high privileged local attacker to bypass protection mechanisms.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-90720 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90720.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 6.7, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-90720" }, { "cve": "CVE-2026-90726", "cwe": { "id": "CWE-28", "name": "Path Traversal: '..\\filedir'" }, "notes": [ { "category": "other", "text": "Path Traversal: '..\\filedir'", "title": "CWE-28" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have a Path Traversal vulnerability enabling a high privileged local attacker to cause Denial of Service.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-90726 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90726.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H", "baseScore": 6.0, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-90726" }, { "cve": "CVE-2026-90728", "notes": [ { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and LTS2024 to LTS2026 releases have an Improper Privilege Management vulnerability enabling high privileged local attackers to escalate privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-90728 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90728.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "baseScore": 6.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-90728" }, { "cve": "CVE-2026-90729", "notes": [ { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and LTS2024 to LTS2026 releases have an Improper Privilege Management vulnerability enabling high privileged remote attackers to escalate privileges.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-90729 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90729.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "baseScore": 6.7, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-90729" }, { "cve": "CVE-2026-90730", "notes": [ { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and LTS2024 to LTS2026 releases have an Improper Access Control vulnerability enabling unauthenticated remote attackers to cause denial of service.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-90730 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-90730.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-90730" }, { "cve": "CVE-2026-94346", "cwe": { "id": "CWE-31", "name": "Path Traversal: 'dir\\..\\..\\filename'" }, "notes": [ { "category": "other", "text": "Path Traversal: 'dir\\..\\..\\filename'", "title": "CWE-31" }, { "category": "description", "text": "PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.7 and various LTS2024, LTS2025, and LTS2026 releases have a Path Traversal vulnerability enabling high privileged remote attackers to execute commands.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-94346 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-94346.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-94346" }, { "cve": "CVE-2026-94347", "notes": [ { "category": "description", "text": "PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.7 and various LTS releases have a Process Control vulnerability enabling a high privileged remote attacker to bypass protection mechanisms.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-94347 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-94347.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-94347" }, { "cve": "CVE-2026-103779", "notes": [ { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024-2026 releases have an Improper Authentication vulnerability allowing low privileged remote attackers to bypass protection mechanisms.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103779 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103779.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "baseScore": 8.3, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-103779" }, { "cve": "CVE-2026-103780", "cwe": { "id": "CWE-121", "name": "Stack-based Buffer Overflow" }, "notes": [ { "category": "other", "text": "Stack-based Buffer Overflow", "title": "CWE-121" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases have a stack-based buffer overflow vulnerability enabling unauthenticated remote command execution.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103780 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103780.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-103780" }, { "cve": "CVE-2026-103792", "cwe": { "id": "CWE-89", "name": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "title": "CWE-89" }, { "category": "description", "text": "Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and LTS2024-2026 releases have an SQL Injection vulnerability enabling low-privileged remote attackers to gain unauthorized access to managed systems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103792 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103792.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "baseScore": 9.6, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-103792" }, { "cve": "CVE-2026-103799", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain a Missing Authorization vulnerability enabling low privileged remote attackers to perform unauthorized operations on managed systems.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-103799 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-103799.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H", "baseScore": 9.6, "baseSeverity": "CRITICAL" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-103799" }, { "cve": "CVE-2026-110540", "cwe": { "id": "CWE-862", "name": "Missing Authorization" }, "notes": [ { "category": "other", "text": "Missing Authorization", "title": "CWE-862" }, { "category": "description", "text": "Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and LTS2024 to LTS2026 releases contain a Missing Authorization vulnerability enabling low privileged remote attackers to perform unauthorized operations.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-110540 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-110540.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L", "baseScore": 7.1, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-110540" }, { "cve": "CVE-2026-110541", "cwe": { "id": "CWE-78", "name": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" }, "notes": [ { "category": "other", "text": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "title": "CWE-78" }, { "category": "description", "text": "Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and various LTS releases have an OS Command Injection vulnerability allowing high privileged remote attackers to execute arbitrary commands.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] }, "references": [ { "category": "self", "summary": "CVE-2026-110541 | NCSC-NL Website", "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-110541.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1", "CSAFPID-2", "CSAFPID-3" ] } ], "title": "CVE-2026-110541" } ] }