CVE-2026-21830 is a low-severity vulnerability in HCL BigFix AEX version 13.0 caused by improper input validation in the aws-sdk package. This flaw may lead to AWS API requests being sent to unintended or non-AWS endpoints. The vulnerability does not impact integrity or availability and requires network access with high attack complexity and no privileges or user interaction. A patch is available, and the product is a cloud service with vendor-managed remediation.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a low privileged attacker with remote access to gain unauthorized access. The vulnerability has a high severity score of 8.8 (CVSS 3.1) indicating critical impact on confidentiality, integrity, and availability.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an out-of-bounds write vulnerability. This flaw could be exploited by a low privileged attacker with remote access to cause a denial of service condition.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper authentication vulnerability. This flaw allows a low privileged attacker with remote access to potentially bypass protection mechanisms. The vulnerability has a high severity with a CVSS score of 8.3. No public exploits or known active exploitation are reported. Patch status is not confirmed due to lack of vendor advisory or patch information.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw allows an unauthenticated remote attacker to potentially execute arbitrary commands on affected systems. The vulnerability has a critical CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the data. No known exploits in the wild have been reported.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an OS command injection vulnerability. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS 3.1 base score of 7.2, indicating high severity. No public exploits or known active exploitation have been reported. Patch availability is not confirmed from the provided data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a vulnerability related to allocation of resources without limits or throttling. This flaw could allow an unauthenticated remote attacker to cause a denial of service condition. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on availability. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the source data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a heap-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. There is no information on available patches or vendor advisories. No known exploits are reported in the wild.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an OS Command Injection vulnerability. A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS 3.1 score of 7.2, indicating high severity. No information about patches or fixes is provided in the data. No known exploits in the wild have been reported.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to potentially gain unauthorized access to the system. The vulnerability is identified as CWE-862 and has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality. No public exploits or known exploitation in the wild have been reported. Patch or remediation details are not provided in the available data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper privilege management vulnerability. This flaw allows a high privileged attacker with remote access to potentially elevate their privileges further. The vulnerability is identified as CWE-269 and has a CVSS v3.1 score of 7.2, indicating a high severity impact on confidentiality, integrity, and availability. No public exploits or patches are currently documented in the provided data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated remote attacker could exploit this flaw to expose credentials, potentially allowing access to the system with the privileges of the compromised user. The vulnerability is rated critical with a CVSS score of 9.8.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, and specific LTS2024, LTS2025, and LTS2026 release versions contain a path traversal vulnerability. This flaw allows an unauthenticated remote attacker to potentially access the filesystem. The vulnerability is identified as CWE-22 and has a CVSS 3.1 base score of 5.3, indicating medium severity. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the available data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an integer overflow or wraparound vulnerability. A high privileged attacker with remote access could exploit this flaw to achieve code execution. The vulnerability is tracked as CVE-2026-86389 and has a CVSS 3.1 base score of 7.2, indicating high severity. No patch or remediation information is provided in the available data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an integer overflow or wraparound vulnerability. This flaw could allow a high privileged remote attacker to bypass protection mechanisms. The vulnerability has a CVSS score of 7.2, indicating high severity. No public exploits or patches are currently documented.
HCL BigFix AEX version 13.0.0.1 is affected by a Server-Side Request Forgery (SSRF) vulnerability. This flaw could allow an attacker with low privileges to cause the application to send unauthorized requests to external resources. Exploitation may lead to access to unintended services or disclosure of sensitive information. The vulnerability has a medium severity rating with a CVSS score of 4.2.
HCL BigFix AEX version 13.0.0.1 is affected by a Clickjacking vulnerability (CWE-1021) that allows attackers to embed the application in malicious web pages or iframes. This can trick users into performing unintended actions, potentially causing unauthorized transactions or account changes. The vulnerability has a CVSS 3.1 score of 6.4, indicating medium severity.
HCL BigFix AEX version 13.0.0.1 contains an information disclosure vulnerability due to improper handling of error messages. This flaw can reveal sensitive technical information such as stack traces, system details, or internal paths. Such disclosures may aid attackers in crafting further attacks. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No public exploits or patches are currently documented.
HCL BigFix AEX version 13.0.0.1 suffers from an unrestricted file upload vulnerability that allows attackers to upload malicious or unauthorized files. This flaw also involves improper access control, enabling direct access or download of sensitive uploaded content. Exploitation could lead to information disclosure, unauthorized access, or system compromise.
CVE-2026-67074 is a critical remote code execution vulnerability in HCL BigFix AEX version 13.0.0.1. It allows attackers to execute arbitrary code with the privileges of the affected application, potentially leading to unauthorized access, data exposure, or full system compromise.