# Dell PowerProtect Data Domain Multiple Vulnerabilities: Improper Authentication (CVE-2026-53483) and Path Traversal (CVE-2026-53481) Allow Full Remote System Access

> Dell disclosed two critical (CVSS 9.8) unauthenticated remote vulnerabilities in PowerProtect Data Domain / DD OS: an improper authentication flaw (CVE-2026-53483, CWE-287) and a path traversal flaw (CVE-2026-53481, CWE-22), either of which can grant an unauthenticated network attacker complete control of the backup appliance. No active exploitation or public PoC has been reported; Dell has released patched DD OS builds.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1371
- **ID:** TL-2026-1371
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-53483, CVE-2026-53481

## Description

On July 7, 2026, Dell published Security Advisory DSA-2026-278 disclosing two critical vulnerabilities in Dell PowerProtect Data Domain, Data Domain Virtual Edition, Dell APEX Protection Storage, and Data Domain Management Center. Both flaws carry the maximum practical CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning they are remotely exploitable over the network, require no authentication, no privileges, and no user interaction, and yield complete compromise of confidentiality, integrity, and availability.

CVE-2026-53483 is an Improper Authentication vulnerability (CWE-287) in the DD OS management/administration interface. An unauthenticated attacker with network access to the appliance can bypass authentication controls to gain unauthorized device access, potentially achieving full administrative control of the Data Domain system without ever presenting valid credentials.

CVE-2026-53481 is a Path Traversal vulnerability (CWE-22, Improper Limitation of a Pathname to a Restricted Directory) in DD OS, also exploitable by an unauthenticated remote attacker. Path traversal in a backup-storage OS context is particularly severe: it can allow reads/writes outside the intended restricted directory tree, exposing configuration data, credential material, backup catalogs, or enabling the attacker to place or overwrite files used to escalate to full system compromise.

Because Data Domain appliances function as the last line of defense for enterprise backup and recovery data, an unauthenticated attacker chaining or independently exploiting either flaw could tamper with or destroy backup integrity, exfiltrate sensitive backed-up data, and disable an organization's ransomware-recovery capability -- a high-value target profile consistent with pre-ransomware "backup poisoning" operations observed against other backup/storage vendors industry-wide.

Both CVEs affect DD OS release versions 7.7.1.0 through 8.7.0.0, as well as the LTS2024 (7.13.1.0-7.13.1.70), LTS2025 (8.3.1.0-8.3.1.30), and LTS2026 (8.6.1.0-8.6.1.10) long-term-support branches. Dell credits external researcher Ahmed Y. Elmogy for responsibly reporting both issues. As of publication, Dell states no active exploitation in the wild and no public proof-of-concept exploit code; the vulnerabilities were disclosed coordinated with patch availability. Fixed versions are DD OS 8.8.0.0 (or 8.7.0.0+ per Dell's general release track), 8.6.1.20 (LTS2026), 8.3.1.40 (LTS2025), and 7.13.1.80 (LTS2024).

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1190 Exploit Public-Facing Application
- T1212 Exploitation for Credential Access
- T1211 Exploitation for Stealth
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1485 Data Destruction
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1561 Disk Wipe
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1059 Command and Scripting Interpreter
- T1548 Abuse Elevation Control Mechanism
- T1499 Endpoint Denial of Service

## Sources

- [DSA-2026-278: Security Update for Dell PowerProtect Data Domain Multiple Vulnerabilities](https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities)
- [Multiple Dell PowerProtect Vulnerabilities Let Attackers Gain Full Remote Access](https://cybersecuritynews.com/multiple-dell-powerprotect-vulnerabilites/)
- [CVE-2026-53483 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-53483)
- [CVE-2026-53481 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-53481)
- [CVE-2026-53483 | THREATINT](https://cve.threatint.eu/CVE/CVE-2026-53483)
- [CVE-2026-53481 | THREATINT](https://cve.threatint.eu/CVE/CVE-2026-53481)
- [CWE-287: Improper Authentication - MITRE](https://cwe.mitre.org/data/definitions/287.html)
- [CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - MITRE](https://cwe.mitre.org/data/definitions/22.html)
- [CVE-2026-54483 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-54483)
- [Dell PowerProtect Data Domain OS Command Injection Detail (CVE-2026-53479) - VulDB](https://vuldb.com/vuln/376111)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1371