CVE-2026-23776

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60, contain(s) an Improper Certificate Validation vulnerability in certificate-based login. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dell:powerprotect_dp_series_appliance::::::::
	cpe:2.3:o:dell:data_domain_operating_system::::::::
	cpe:2.3:o:dell:data_domain_operating_system::::::::
	cpe:2.3:o:dell:data_domain_operating_system::::::::

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Dell PowerProtect Data Domain con Data Domain Operating System (DD OS) de las versiones Feature Release 7.7.1.0 a 8.5, la versión LTS2025 8.3.1.0 a 8.3.1.20, las versiones LTS2024 7.13.1.0 a 7.13.1.60, contiene una vulnerabilidad de validación de certificado incorrecta en el inicio de sesión basado en certificados. Un atacante con pocos privilegios con acceso remoto podría potencialmente explotar esta vulnerabilidad, lo que podría llevar a una elevación de privilegios.

Information

Published : 2026-04-17 10:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-23776

Mitre link : CVE-2026-23776

CVE.ORG link : CVE-2026-23776

JSON object : View

Products Affected

dell

powerprotect_dp_series_appliance
data_domain_operating_system

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2026-23776", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23776", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-18T03:55:48.754706Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security_alert@emc.com", "affectedData": [{"vendor": "Dell", "product": "PowerProtect Data Domain", "versions": [{"status": "affected", "version": "0", "lessThan": "8.3.1.30 or later", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "7.13.1.70 or later", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "8.6.0.0 or later", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2.7.9 with DD OS 8.3.1.30", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-17T10:16:04.020", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities", "tags": ["Patch", "Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60, contain(s) an Improper Certificate Validation vulnerability in certificate-based login. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges."}, {"lang": "es", "value": "Dell PowerProtect Data Domain con Data Domain Operating System (DD OS) de las versiones Feature Release 7.7.1.0 a 8.5, la versi\u00f3n LTS2025 8.3.1.0 a 8.3.1.20, las versiones LTS2024 7.13.1.0 a 7.13.1.60, contiene una vulnerabilidad de validaci\u00f3n de certificado incorrecta en el inicio de sesi\u00f3n basado en certificados. Un atacante con pocos privilegios con acceso remoto podr\u00eda potencialmente explotar esta vulnerabilidad, lo que podr\u00eda llevar a una elevaci\u00f3n de privilegios."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:powerprotect_dp_series_appliance:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9AD58029-9254-43B4-8CD0-3E5B90B3233B", "versionEndExcluding": "2.7.9"}, {"criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC897776-0E86-478C-B120-1D5D89C2B488", "versionEndExcluding": "7.13.1.70", "versionStartIncluding": "7.7.1.0"}, {"criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A28B7834-5B62-4CDE-B628-0BAC62AADD08", "versionEndExcluding": "8.3.1.30", "versionStartIncluding": "7.14.0.0"}, {"criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB7229F8-52FA-4351-ADA7-B2F42940FAC1", "versionEndExcluding": "8.6.0.0", "versionStartIncluding": "8.4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}