Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through
Source GCVE Database
Not known to be exploited · CVSS 6.5 Medium · fixed in 8.9.0.0 or later : update PowerProtect Data Domain when convenient.
Data as of 27 Oct 2026, 13:14 UTC
- Patch
- Available – fixed in 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later +1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:LExploitation evidence
Disclosed: evidence found.
CVE published 27 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade PowerProtect Data Domain to 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later or 7.13.1.90 or later.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| DellPowerProtect Data Domain | Affected
| Fixed in
|
AI-suggested
If you cannot patch yet, restricting remote access to the affected systems and applying network-level protections may reduce exposure.
Description
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper access control vulnerability. This flaw allows an unauthenticated remote attacker to potentially cause a denial of service. The vulnerability does not impact confidentiality but can affect system availability. No public exploits or known active exploitation have been reported. The CVSS v3.1 base score is 6.5, indicating a medium severity level.