CVE-2026-41124
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Dell PowerProtect Data Domain in multiple versions contains a path traversal vulnerability due to improper limitation of a pathname to a restricted directory. This allows a high-privileged attacker with local access to potentially expose sensitive information.
Risk Assessment
The risk involves potential leakage of confidential data stored in the system, which could compromise the organization's information security.
Recommendation
It is recommended to immediately update Dell PowerProtect Data Domain to the latest available version that addresses this vulnerability.
Original NVD description (English source)
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.