CVE-2026-56084: Dell PowerProtect Data Domain · Server-Side Request Forgery (SSRF)
Affects Dell PowerProtect Data DomainSource CVE Database V5
Not known to be exploited · CVSS 5.8 Medium · fixed in 8.9.0.0 or later : update Dell PowerProtect Data Domain when convenient.
Data as of 27 Oct 2026, 11:42 UTC
- Patch
- Available – fixed in 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later +1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 27 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Dell PowerProtect Data Domain to 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later or 7.13.1.90 or later.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| DellPowerProtect Data Domain | Affected
| Fixed in
|
AI-suggested
Apply the official patches by upgrading to Dell PowerProtect Data Domain versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, or 7.13.1.90 or later as appropriate. No other mitigations or vendor advisories indicating alternative actions are provided.
Description
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7, including several LTS releases, contain a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). This vulnerability allows an unauthenticated remote attacker to induce the server to make unintended requests. The issue is fixed in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later.