Threat reportVulnerabilityTL-2026-4974

Dell PowerProtect Data Domain multiple vulnerabilities fixed (DSA-2026-416, NCSC-2026-0460)

criticalPATCHED

Dell PowerProtect Data Domain multiple vulnerabilities fixed (TL-2026-4974), also tracked as DSA-2026-416, is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-11-01. It has no confirmed attribution, affects Dell PowerProtect Data Domain (DD OS), references 33 CVEs (CVE-2026-103780, CVE-2026-86384, CVE-2026-86397), maps to 6 MITRE ATT&CK techniques (T1059.004, T1078, T1136.001), and is covered by 9 detection rules and 8 indicators of compromise.

CVSS
9.8/10Critical
CVEs
33Referenced vulnerabilities
Techniques
6MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
8Indicators of compromise

Key facts for TL-2026-4974

Threat ID
TL-2026-4974
Also known as
DSA-2026-416, NCSC-2026-0460
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
enterprise, government administration, finance, health, cloud and data-center operators
Target regions
Global
Detection rules
9
Indicators of compromise
8

How Dell PowerProtect Data Domain multiple vulnerabilities fixed works

Dell DSA-2026-416 / NCSC-NL NCSC-2026-0460 fix 38 vulnerabilities in Dell PowerProtect Data Domain, Data Domain Virtual Edition and Data Domain Management Center, including unauthenticated command execution, remote privileged account creation, root command execution via authentication bypass and hard-coded cryptographic keys (four CVEs at CVSS 9.8). No active exploitation or public PoC is stated in the sources.

Dell security advisory DSA-2026-416 (initial release 2026-10-01, revisions 2.0 on 2026-10-07 and 3.0 on 2026-10-19 per the Dell revision history) was summarized by NCSC-NL as NCSC-2026-0460 (published 2026-10-30, status Final, v1.0.0). The advisory covers 38 proprietary vulnerabilities in Dell PowerProtect Data Domain spanning stack-based buffer overflow, out-of-bounds write, OS command injection, SQL injection, path traversal, integer overflow, hard-coded cryptographic keys, improper authentication, authentication spoofing, improper privilege drop/management and missing authorization. NCSC-NL rates probability as Medium and impact as High. The advisory also lists many third-party component CVEs (Apache HTTP Server, OpenSSL, Python, Lodash, rsync, nginx, libexpat, curl, PostgreSQL libpq5, PKIXSSH and others) remediated through the updated system versions.

Seven vulnerabilities are rated Critical. Four score CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): CVE-2026-103780 (stack-based buffer overflow; an unauthenticated attacker with remote access can reach command execution), CVE-2026-86384 (use of hard-coded cryptographic key; credential exposure and privileged access without authentication), CVE-2026-86397 (privileged account creation by an unauthenticated remote attacker; Dell labels it Improper Authentication while the NCSC CSAF labels the weakness Missing Authorization) and CVE-2026-86400 (improper authentication allowing arbitrary command execution with root privileges). Three further Critical flaws are specific to Data Domain Management Center and affect managed systems with a changed scope: CVE-2026-103799 (missing authorization, CWE-862, CVSS 9.6), CVE-2026-103792 (SQL injection, CWE-89, CVSS 9.6) and CVE-2026-90717 (authentication bypass by spoofing, CWE-290, CVSS 9.1, privilege elevation affecting other Data Domain systems).

High-severity entries (CVSS 7.1-8.8) include CVE-2026-86378 (stack-based buffer overflow, CWE-121), CVE-2026-86385 (improper privilege drop, CWE-273), CVE-2026-86396 (OS command injection, CWE-78, AV:N/AC:L/PR:L, low-privileged remote attacker, EPSS 2.2% per OpenCVE), CVE-2026-86398 (path traversal, CWE-22), CVE-2026-103779 (improper authentication, 8.3), CVE-2026-86377 (out-of-bounds write, 7.6) and a cluster of 7.2-rated OS command injection (CVE-2026-86379, -86394, -86395, -86399, -110541), integer overflow (CVE-2026-86380, -86389), improper privilege management (CVE-2026-86393), path traversal (CVE-2026-94346) and process control (CVE-2026-94347) flaws, plus missing authorization CVE-2026-110540 (7.1). Medium entries (CVSS 6.0-6.8) are CVE-2026-68866, -86383, -86390, -86391, -90720, -90726, -90728, -90729 and -90730 (relative path traversal, path traversal, missing authorization, authentication bypass, improper integrity validation, privilege management and access control). The NCSC CSAF names 33 of the 38 proprietary CVE IDs; the remaining five are not enumerated in the retrieved sources.

Affected: DD OS Feature Release 7.7.1.0 through 8.8.0.0, LTS2024 7.13.1.0-7.13.1.80, LTS2025 8.3.1.0-8.3.1.40 and LTS2026 8.6.1.0-8.6.1.20 (Data Domain Virtual Edition and Management Center are also affected). Fixed in DD OS 8.9.0.0, 7.13.1.90 (LTS2024), 8.3.1.50 (LTS2025) and 8.6.1.30 (LTS2026) or later. Dell documents no workarounds beyond upgrading; the OpenCVE/NVD-derived description for CVE-2026-86396 and NCSC mention restricting remote access to trusted administrators as an interim measure. Context: this is not Dell's first critical Data Domain advisory this year; DSA-2026-278 (revision 3.0 dated 2026-07-09) covered two other unauthenticated CVSS 9.8 flaws (CVE-2026-53483, CVE-2026-53481), also with no confirmed exploitation or public PoC. Data Domain systems commonly hold backup data, so appliance compromise is a high-value position for an attacker; that is an analyst inference, not a source claim. The sources state no in-the-wild exploitation, no public PoC and no network IOCs.

MITRE ATT&CK techniques used in TL-2026-4974

Execution

T1059.004 Unix Shell

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1136.001 Local Account

Credential Access

T1212 Exploitation for Credential Access; T1552 Unsecured Credentials

Affected products and versions in Dell PowerProtect Data Domain multiple vulnerabilities fixed

  • Dell — PowerProtect Data Domain (DD OS)
    Vulnerable versions: Feature Release 7.7.1.0-8.8.0.0; LTS2024 7.13.1.0-7.13.1.80; LTS2025 8.3.1.0-8.3.1.40; LTS2026 8.6.1.0-8.6.1.20
    Fixed in: 8.9.0.0; 7.13.1.90 (LTS2024); 8.3.1.50 (LTS2025); 8.6.1.30 (LTS2026)
  • Dell — PowerProtect Data Domain Virtual Edition
    Vulnerable versions: Versions affected per DSA-2026-416
    Fixed in: 8.9.0.0; 7.13.1.90 (LTS2024); 8.3.1.50 (LTS2025); 8.6.1.30 (LTS2026)
  • Dell — PowerProtect Data Domain Management Center
    Vulnerable versions: Versions affected per DSA-2026-416
    Fixed in: 8.9.0.0; 7.13.1.90 (LTS2024); 8.3.1.50 (LTS2025); 8.6.1.30 (LTS2026)

Remediation for Dell PowerProtect Data Domain multiple vulnerabilities fixed

Patches

  • DD OS 8.9.0.0 or later
  • DD OS 7.13.1.90 or later (LTS2024)
  • DD OS 8.3.1.50 or later (LTS2025)
  • DD OS 8.6.1.30 or later (LTS2026)

Immediate actions

  • Apply Dell DSA-2026-416 updates to all PowerProtect Data Domain, Data Domain Virtual Edition and Data Domain Management Center installations
  • Restrict remote access to Data Domain management interfaces to trusted administrators only
  • Review Data Domain and Management Center accounts for unexpected privileged account creation

Workarounds

  • Restrict remote access to trusted administrators (interim measure cited for CVE-2026-86396; Dell documents no formal workarounds)

Longer-term hardening

  • Isolate backup appliance management networks from general user and server networks
  • Forward Data Domain and Management Center authentication and administrative logs to the SIEM
  • Rotate credentials stored on or managed by affected appliances after patching (relevant to hard-coded key CVE-2026-86384)

CVEs associated with Dell PowerProtect Data Domain multiple vulnerabilities fixed

Weaknesses (CWE) in Dell PowerProtect Data Domain multiple vulnerabilities fixed

CWE-121, CWE-787, CWE-78, CWE-89, CWE-22, CWE-23, CWE-190, CWE-321, CWE-862, CWE-287

Timeline of Dell PowerProtect Data Domain multiple vulnerabilities fixed

  • Related earlier Dell advisory DSA-2026-278 (revision 3.0) covers two other unauthenticated CVSS 9.8 Data Domain flaws, CVE-2026-53483 and CVE-2026-53481; no confirmed exploitation
  • CVE-2026-86396 (OS command injection in Data Domain) reserved per OpenCVE
  • Dell publishes DSA-2026-416 (revision 1.0, initial release) for PowerProtect Data Domain
  • Dell DSA-2026-416 revision 2.0 (minor updates)
  • Dell DSA-2026-416 revision 3.0 adds CVE details for proprietary code vulnerabilities
  • CVE-2026-86396 publicly published (CVSS 8.8, EPSS 2.2% per OpenCVE); Dell recommends applying the update or restricting remote access to trusted administrators
  • CVE-2026-86396 record last updated per OpenCVE; no active exploitation or public PoC stated in sources
  • Fixes available in DD OS 8.9.0.0, 7.13.1.90 (LTS2024), 8.3.1.50 (LTS2025) and 8.6.1.30 (LTS2026) or later
  • NCSC-NL publishes NCSC-2026-0460 (Final, v1.0.0, 09:10 UTC) reporting 38 vulnerabilities fixed in Dell PowerProtect Data Domain; probability Medium, impact High

Sources cited for Dell PowerProtect Data Domain multiple vulnerabilities fixed

Detection coverage for TL-2026-4974

As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4974 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
8 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats