CVE-2026-28263 is a cross-site scripting vulnerability (CWE-79) in Dell PowerProtect Data Domain with Data Domain Operating System versions 7.7.1.0 through 8.5, LTS2025 8.3.1.0 through 8.3.1.20, and LTS2024 7.13.1.0 through 7.13.1.50. A high privileged attacker with remote access could exploit improper input neutralization during web page generation to inject malicious scripts. The vulnerability has a CVSS 3.1 base score of 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L), reflecting network attack vector, low attack complexity, required high privileges, user interaction required, scope changed, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow a high privileged remote attacker to perform script injection, potentially leading to limited confidentiality, integrity, and availability impacts within the affected system. The vulnerability requires user interaction and high privileges, limiting the ease of exploitation. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote access to trusted administrators only and apply standard web application security best practices to limit exposure. Monitor Dell's official security advisories for updates regarding patches or mitigations.