Dell fixes unauthenticated flaws in PowerProtect appliances

Dell has issued a security advisory, DSA-2026-416, detailing more than 180 CVEs across its PowerProtect Data Domain backup appliances, including 48 Dell-specific vulnerabilities. Four of these are rated CVSS v3.1 at 9.8 and are exploitable without login. Dell warns that unauthenticated attackers could achieve root command execution or create privileged accounts on Data Domain systems, and notes the advisory also patches numerous third‑party components bundled inside DD OS. The firm states the overall impact is Critical and urges customers to upgrade to fixed DD OS releases promptly.

The article summarises the principal issues as follows: four Dell-specific flaws allow unauthenticated access to high‑impact outcomes, such as arbitrary command execution with root privileges (CVE-2026-86400), privileged account creation (CVE-2026-86397), exposure of credentials via a hard-coded key (CVE-2026-86384), and a stack-based buffer overflow enabling command execution (CVE-2026-103780).

Management Center flaws (CVE-2026-103799, CVE-2026-103792, CVE-2026-90717) could let a low‑privileged user reach managed systems through missing authorisation, SQL injection, or authentication bypass, with several of these rated 9.6 or higher. Authenticated flaws include OS command injection (CVE-2026-86396) and path traversal (CVE-2026-86398), among others, some requiring admin rights.

Dell lists affected versions across DD OS branches (Feature Release 7.7.1.0–8.8, LTS2024 7.13.1.0–7.13.1.80, LTS2025 8.3.1.0–8.3.1[.]40, LTS2026 8.6.1[.]0–8.6.1[.]20) and provides fixes in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 or 8.6.1.30, with Virtual Edition having a separate table. The advisory notes that there have been no confirmed exploits and that Dell credits Ahmed Y. Elmogy and songxiaoyue for several CVEs.