Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains an Improper Certificate Validation vulnerability in certificate-based login. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges. This issue affects multiple feature release versions and could have significant security implications.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.2 | CVE-2026-23776 |
Exploitation
To exploit this vulnerability, an attacker with low privileges and remote access can manipulate the certificate validation process during login. By bypassing the proper validation checks, the attacker may gain elevated privileges, allowing them to perform unauthorized actions within the system.
Affected Products
- Feature Release versions 7.7.1.0 through 8.5
- LTS2025 release version 8.3.1.0 through 8.3.1.20
- LTS2024 release versions 7.13.1.0 through 7.13.1.60
Mitigation
To mitigate this vulnerability, it is recommended to update the affected PowerProtect Data Domain systems to the latest versions that address the improper certificate validation issue. Regularly applying security updates and patches can help protect against potential exploitation.