CVE-2026-103799

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-28 · updated 2026-10-28
Weakness: CWE-862

Description

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized system operation on managed systems.

Summary

CVE-2026-103799 is a missing authorization vulnerability in Dell PowerProtect Data Domain Management Center rated CVSS 9.6 (critical). A low-privileged attacker with remote access could exploit it to perform unauthorized system operations on managed systems. Affected versions include Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The flaw is not listed in CISA KEV; no confirmed exploitation is reported. Apply the fixed releases: 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later, or 8.6.1.30 or later.

CVE-2026-103799 هو ثغرة نقص في التفويض (Missing Authorization) في Dell PowerProtect Data Domain Management Center بتقييم CVSS 9.6 (حرجة). يمكن لمهاجم منخفض الصلاحيات لديه وصول عن بُعد استغلالها لتنفيذ عمليات غير مصرح بها على الأنظمة المُدارة. تشمل الإصدارات المتأثرة Feature Release من 7.7.1.0 حتى 8.8، وLTS2024 من 7.13.1.0 حتى 7.13.1.80، وLTS2025 من 8.3.1.0 حتى 8.3.1.40، وLTS2026 من 8.6.1.0 حتى 8.6.1.20. الثغرة غير مدرجة في CISA KEV ولا توجد تقارير مؤكدة عن استغلالها. يجب التحديث إلى الإصدارات المُصلحة: 8.9.0.0 أو أحدث، أو 7.13.1.90 أو أحدث، أو 8.3.1.50 أو أحدث، أو 8.6.1.30 أو أحدث.

Affected products

Dell PowerProtect DD: before 8.9.0.0 or later; before 7.13.1.90 or later; before 8.3.1.50 or later; before 8.6.1.30 or later — fixed in 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later, 8.6.1.30 or later

How to fix

Upgrade to a fixed version: Dell PowerProtect DD 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later, 8.6.1.30 or later. Check the vendor advisory for mitigations.

References

https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities

Get alerted when CVE-2026-103799 or the next vulnerability affects your stack