CVE-2026-41122 is a stored cross-site scripting vulnerability in Dell PowerProtect Data Domain affecting versions 7.7.1.0 through 8.7, LTS2026 release 8.6.1.0 through 8.6.1.10, LTS2025 release 8.3.1.0 through 8.3.1.30, and LTS2024 release 7.13.1.0 through 7.13.1.70. The vulnerability allows an unauthenticated attacker with remote access to inject malicious scripts into web pages generated by the product. Exploitation can result in information disclosure, session hijacking, or client-side request forgery. The CVSS vector indicates the attack requires no privileges and low attack complexity but does require user interaction. The vulnerability impacts confidentiality, integrity, and availability to a limited extent. No vendor advisory or patch information is currently available.

Successful exploitation of this stored XSS vulnerability can lead to information disclosure, theft of user sessions, and client-side request forgery. This can compromise user accounts and potentially allow further attacks against users interacting with the affected web interface. The vulnerability affects confidentiality, integrity, and availability to some degree as indicated by the CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider limiting remote access to the affected web interface and applying web application firewall rules to detect and block XSS payloads. Monitor vendor communications for updates on patches or mitigations.