CVE-2026-23777
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) in Feature Release versions 7.7.1.0 through 8.5, LTS2025 8.3.1.0 through 8.3.1.20, and LTS2024 7.13.1.0 through 7.13.1.50 contains an exposure of sensitive information to an unauthorized actor vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
Risk Assessment
Sensitive data may be exposed by a remote low-privileged attacker, creating a risk of information leakage from the backup system. Organizations storing sensitive data in PowerProtect Data Domain are exposed to unauthorized disclosure.
Recommendation
Update DD OS to a patched version and restrict remote access to device interfaces to trusted networks. Monitor logs for unusual access attempts by low-privileged accounts.
Other vulnerabilities in Dell PowerProtect Data Domain (DD OS)
See all- CVE-2026-28263Medium
Dell PowerProtect Data Domain with DD OS contains a cross-site scripting vulnerability. A high-privileged attacker with remote access could exploit it to inject scripts.
- CVE-2026-23779Medium
Dell PowerProtect Data Domain with DD OS in Feature Release versions 7.7.1.0 through 8.5, LTS2025 8.3.1.0 through 8.3.1.20, and LTS2024 7.13.1.0 through 7.13.1.50 contains a command injection vulnerability. A high-privileged attacker with local access could exploit it to gain root-level access.
- CVE-2025-43727High
Dell PowerProtect Data Domain with DD OS contains an incorrect implementation of an authentication algorithm in the RestAPI. This affects Feature Release 7.7.1.0 through 8.1.0.10, LTS2024 7.13.1.0 through 7.13.1.25, and LTS 2023 7.10.1.0 through 7.10.1.50. An unauthenticated remote attacker could potentially exploit this to gain unauthorized access.
Original NVD description (English source)
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain an exposure of sensitive information to an unauthorized actor vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS