Introduction
Dell PowerProtect Data Domain appliances are central to enterprise backup and recovery, so any remotely exploitable vulnerability in their operating system is a serious concern for infrastructure teams. CVE-2026-26354 is a stack-based buffer overflow in the Data Domain Operating System (DD OS) that lets an unauthenticated attacker with network access execute arbitrary commands. An attacker who exploits it could compromise the integrity of an organization's entire backup infrastructure.
Dell PowerProtect Data Domain is a purpose-built backup storage platform that provides deduplicated, high-performance data protection at scale. Enterprises worldwide deploy these all-flash appliances as critical infrastructure for cyber resilience and disaster recovery. Because they are the last line of defense for data restoration, a compromise of these systems has outsized consequences for business continuity.
Technical information
CVE-2026-26354 is classified under CWE-121 (stack-based buffer overflow). In this class of vulnerability, a program writes data past the boundary of a stack-allocated buffer and can overwrite adjacent memory, including return addresses and saved frame pointers. When an attacker controls the overflowed data, they can redirect execution to attacker-supplied instructions or use return-oriented programming to achieve arbitrary command execution.
The CVSS 3.1 vector string assigned by Dell is:
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
This gives a base score of 8.2. The individual metrics break down as follows.
Attack Vector: Network. An attacker does not need local or physical access to the Data Domain appliance. This matters because Data Domain systems are often accessible on management networks and, in some deployments, may be reachable from broader network segments.
Attack Complexity: High. The vulnerability is remotely exploitable, but the conditions needed to trigger the overflow are not trivial. This could mean that specific timing, configuration states, or protocol interactions are necessary to reach the vulnerable code path. The High rating is the main reason the CVSS score falls below 9.0, but it should not be read as a reliable barrier against motivated attackers.
Privileges Required: None. The attacker can trigger the overflow as a completely unauthenticated remote user, with no credentials and no existing foothold on the target system.
User Interaction: None. No legitimate user has to click a link, open a file, or take any other action. The attack can be fully automated.
Impact: High across all three pillars. Successful exploitation compromises confidentiality, integrity, and availability completely. The advisory states that exploitation leads to "arbitrary command execution," which on a Data Domain appliance could mean access to backup data, modification of backup policies, destruction of recovery points, or lateral movement into connected infrastructure.
The public advisory does not name the network service, protocol, or listening port that exposes this buffer overflow, and that leaves defenders with a real gap. Without knowing which service is vulnerable, they have to apply network segmentation and firewall rules broadly and restrict all unnecessary access to Data Domain appliances. Until patches are applied, defenders should treat the entire network perimeter of the appliance as potentially hostile.
The advisory (DSA-2026-060) documents this vulnerability alongside several other issues, which suggests the DD OS attack surface went through a broader security review. CVE-2026-26354 was added in the advisory's fourth revision on April 20, 2026, six days after the initial publication on April 14, 2026. This revision pattern indicates that Dell's security team was actively triaging and disclosing additional findings as it confirmed them.
Affected systems and versions
The following DD OS versions and product families are confirmed vulnerable:
| Product Family | Affected Versions |
|---|---|
| DD OS Feature Release | 7.7.1.0 through 8.6.0.0 |
| DD OS LTS2025 (8.3.1 branch) | 8.3.1.0 through 8.3.1.10 |
| DD OS LTS2024 (7.13.1 branch) | 7.13.1.0 through 7.13.1.60 |
| PowerProtect DP Series Appliance | Versions prior to 2.7.9 |
The remediated versions are:
| Product Family | Remediated Versions |
|---|---|
| DD OS Feature Release | 8.6.1.10 or 8.7.0.0 or later |
| DD OS LTS2025 (8.3.1 branch) | 8.3.1.20 or later |
| DD OS LTS2024 (7.13.1 branch) | 7.13.1.60 or later |
| PowerProtect DP Series Appliance | Version 2.7.9 with DD OS 8.3.1.30 |
Organizations running any version in the affected ranges should prioritize the upgrade. Moving to the latest feature release (8.7.0.0) also fixes several other critical vulnerabilities documented in the same advisory. The update packages are available through the Dell Support portal.
Vendor security history
Dell's handling of DSA-2026-060 gives some insight into its disclosure process. The advisory was published on April 14, 2026, and went through five revisions over the following week, with CVE-2026-26354 added in the fourth revision on April 20, 2026. That pace suggests an active, evolving investigation, and it is a good reason to check the latest version of vendor documentation before a maintenance window. Organizations that patched based on the initial revision may not have addressed CVE-2026-26354 and should check their current DD OS version against the remediated versions listed above.
