CVE-2026-28263
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
Dell PowerProtect Data Domain with DD OS contains a cross-site scripting vulnerability. A high-privileged attacker with remote access could exploit it to inject scripts.
Risk Assessment
Potential execution of malicious script in a user's browser context, session or data theft, and follow-on attacks. Exploitation requires high attacker privileges.
Recommendation
Update DD OS to the Dell-recommended fixed release. Restrict administrative access to the interface and enforce security headers (CSP) and input validation.
Other vulnerabilities in Dell PowerProtect Data Domain (DD OS)
See all- CVE-2026-23777Medium
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) in Feature Release versions 7.7.1.0 through 8.5, LTS2025 8.3.1.0 through 8.3.1.20, and LTS2024 7.13.1.0 through 7.13.1.50 contains an exposure of sensitive information to an unauthorized actor vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
- CVE-2026-23779Medium
Dell PowerProtect Data Domain with DD OS in Feature Release versions 7.7.1.0 through 8.5, LTS2025 8.3.1.0 through 8.3.1.20, and LTS2024 7.13.1.0 through 7.13.1.50 contains a command injection vulnerability. A high-privileged attacker with local access could exploit it to gain root-level access.
- CVE-2025-43727High
Dell PowerProtect Data Domain with DD OS contains an incorrect implementation of an authentication algorithm in the RestAPI. This affects Feature Release 7.7.1.0 through 8.1.0.10, LTS2024 7.13.1.0 through 7.13.1.25, and LTS 2023 7.10.1.0 through 7.10.1.50. An unauthenticated remote attacker could potentially exploit this to gain unauthorized access.
Original NVD description (English source)
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a cross-site Scripting vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS