Dell has fixed 38 vulnerabilities in its PowerProtect Data Domain backup storage products, including four rated CVSS 9.8 out of 10. The fixes are published in Dell security advisory DSA-2026-416, summarised by the Dutch National Cyber Security Centre as NCSC-2026-0460.

What the most serious flaws allow

Seven of the vulnerabilities are rated critical. Four score 9.8: CVE-2026-103780, a stack-based buffer overflow that could let an unauthenticated attacker with remote access reach command execution; CVE-2026-86384, use of a hard-coded cryptographic key that could expose credentials and privileged access without authentication; CVE-2026-86397, privileged account creation by an unauthenticated remote attacker; and CVE-2026-86400, improper authentication that could allow arbitrary command execution with root privileges. The advisory also covers unauthenticated command execution, remote privileged account creation, root command execution via authentication bypass and hard-coded keys, alongside SQL injection, path traversal, integer overflow and improper privilege handling. No exploit code is reproduced here.

Which systems are affected

The advisory covers Data Domain systems, Data Domain Virtual Edition and Data Domain Management Center, across specified DD OS feature and long-term-support releases. Administrators should check the advisory's affected-version list against their own systems rather than assuming a version is safe, because the range spans several release lines. Dell's advisory was first released on 1 October and revised on 7 and 19 October; the NCSC summary was published on 30 October and the threat record summarising it on 1 November.

What to do, and what is not known

Organisations running affected Data Domain systems should apply the fixed releases and verify the installed version afterwards. No active exploitation and no public proof-of-concept exploit are stated in the sources summarising the advisory. That is not a guarantee that exploitation will not follow, so patching internet-facing or widely reachable backup systems first is the prudent order. Further detail is in the Threadlinqs threat record for TL-2026-4974, which cites Dell advisory DSA-2026-416 and the NCSC summary.