SecuriTricks - CVE-2026-23775

Description

Dell PowerProtect Data Domain appliances with Data Domain Operating System (DD OS) of Feature Release versions 8.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.10 contain an insertion of sensitive information into log file vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to credential exposures. Authentication attempts as the compromised user would need to be authorized by a high privileged DD user. This vulnerability only affects systems with retention lock enabled.

Product(s) Impacted

Vendor	Product	Versions
Dell	Powerprotect Data Domain Data Domain Operating System	* 8.0-8.5, 8.3.1.0-8.3.1.10

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-532

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	dell	powerprotect_data_domain	/	/	/	/	/	/	/	/
a	dell	data_domain_operating_system	8.0-8.5	/	/	/	/	/	/	/
a	dell	data_domain_operating_system	8.3.1.0-8.3.1.10	/	/	/	/	/	/	/

References

https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities

CVSS Score

7.6 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: HIGH
Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H

View Vector String

Timeline

Published: April 17, 2026, 9:16 a.m.
Last Modified: April 17, 2026, 3:07 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

CVE-2026-23775