CVE-2026-28263

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a cross-site Scripting vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.7 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dell:powerprotect_data_domain:::::lts:::*
	cpe:2.3:a:dell:powerprotect_data_domain:::::lts:::*
	cpe:2.3:o:dell:data_domain_operating_system::::::::

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Dell PowerProtect Data Domain con Data Domain Sistema Operativo (DD OS) de las versiones Feature Release 7.7.1.0 a 8.5, la versión LTS2025 8.3.1.0 a 8.3.1.20, las versiones LTS2024 7.13.1.0 a 7.13.1.50, contienen una vulnerabilidad de cross-site scripting. Un atacante con altos privilegios y acceso remoto podría potencialmente explotar esta vulnerabilidad, lo que llevaría a la inyección de scripts.

Information

Published : 2026-04-17 12:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-28263

Mitre link : CVE-2026-28263

CVE.ORG link : CVE-2026-28263

JSON object : View

Products Affected

dell

powerprotect_data_domain
data_domain_operating_system

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-28263", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28263", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-18T02:56:51.600971Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "affected": [{"source": "security_alert@emc.com", "affectedData": [{"vendor": "Dell", "product": "PowerProtect Data Domain", "versions": [{"status": "affected", "version": "0", "lessThan": "8.6.0.0 or later", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "8.3.1.20 or later", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "7.13.1.50 or later", "versionType": "semver"}, {"status": "affected", "version": "0", "lessThan": "2.7.9 with DD OS 8.3.1.30", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-17T12:16:32.473", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a cross-site Scripting vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection."}, {"lang": "es", "value": "Dell PowerProtect Data Domain con Data Domain Sistema Operativo (DD OS) de las versiones Feature Release 7.7.1.0 a 8.5, la versi\u00f3n LTS2025 8.3.1.0 a 8.3.1.20, las versiones LTS2024 7.13.1.0 a 7.13.1.50, contienen una vulnerabilidad de cross-site scripting. Un atacante con altos privilegios y acceso remoto podr\u00eda potencialmente explotar esta vulnerabilidad, lo que llevar\u00eda a la inyecci\u00f3n de scripts."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:powerprotect_data_domain:*:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "76A6BFB2-3530-4520-92F0-675DD6FE4090", "versionEndIncluding": "7.13.1.50", "versionStartIncluding": "7.13.1.0"}, {"criteria": "cpe:2.3:a:dell:powerprotect_data_domain:*:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "422E3848-A1A6-4EB0-A814-9209CD2A667B", "versionEndIncluding": "8.3.1.20", "versionStartIncluding": "8.3.1.0"}, {"criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63D8EE7D-ADB8-4374-936C-B99B86A3F859", "versionEndIncluding": "8.5.0.0", "versionStartIncluding": "7.7.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}