{"id":"CVE-2026-103780","kind":"vulnerability","aliases":["CVE-2026-103780"],"related":[],"title":"Dell PowerProtect Data Domain: stack buffer overflow allows unauthenticated remote command execution","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution.","summary":"Several Dell PowerProtect Data Domain release lines contain a stack-based buffer overflow. An unauthenticated attacker with remote access could potentially run commands on the appliance.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup-appliance","data-domain","dell","infrastructure","powerprotect"],"not_affected_if":["no-remote-access","version-outside-affected-ranges"],"how_to_check":"- Check the installed Data Domain OS version against the affected ranges: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20\n- Confirm whether the appliance management interface is reachable from untrusted networks (unknown from the sources)","fix":"- Move Data Domain OS to a fixed release listed in Dell's advisory for your release line (unknown from the sources)\n- Restrict management and remote access to trusted networks until patched","status":"open","published_at":"2026-10-28T11:17:14+00:00","first_seen_at":"2026-10-28T11:32:27+00:00","triaged_at":"2026-10-28T11:33:15+00:00","updated_at":"2026-10-28T11:33:15+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T11:33:15Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain OS to a fixed release listed in Dell's advisory for your release line (unknown from the sources)\n- Restrict management and remote access to trusted networks until patched","reach":"internet","title":"Dell PowerProtect Data Domain: stack buffer overflow allows unauthenticated remote command execution","impact":"high","summary":"Several Dell PowerProtect Data Domain release lines contain a stack-based buffer overflow. An unauthenticated attacker with remote access could potentially run commands on the appliance.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup-appliance"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs commands on the backup appliance without credentials.","analyst_note":"Fixed version numbers and the Dell advisory URL are not in the sources; check Dell's security advisory for the patched release per line and whether remote access is default.","how_to_check":"- Check the installed Data Domain OS version against the affected ranges: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20\n- Confirm whether the appliance management interface is reachable from untrusted networks (unknown from the sources)","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges","no-remote-access"],"who_is_affected":"Organizations running Dell PowerProtect Data Domain appliances on the affected release lines that have remote access enabled. Appliances outside the listed version ranges, or not reachable from untrusted networks, are less exposed. Whether the exposure depends on a non-default setting is unknown from the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000677,"input_tokens":3413,"output_tokens":672,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-103780':15A,18A '-2026':14A,17A '7.13.1.0':68C '7.13.1.80':70C '7.7.1.0':62C '8.3.1.0':74C '8.3.1.40':76C '8.6.1.0':80C '8.6.1.20':82C '8.8':64C 'access':47B,96C 'allow':8A 'applianc':21B,54B 'attack':44B,93C 'backup':20B 'backup-appli':19B 'base':39B,87C 'buffer':6A,40B,88C 'command':11A,51B,104C 'contain':35B,83C 'could':48B,97C 'cve':13A,16A 'data':3A,23B,31B,57C 'data-domain':22B 'dell':1A,25B,29B,55C 'domain':4A,24B,32B,58C 'execut':12A,105C 'exploit':99C 'featur':59C 'infrastructur':26B 'lead':102C 'line':34B 'lts2024':65C 'lts2025':71C 'lts2026':77C 'overflow':7A,41B,89C 'potenti':49B,98C 'powerprotect':2A,27B,30B,56C 'releas':33B,60C,66C,72C,78C 'remot':10A,46B,95C 'run':50B 'sever':28B 'stack':5A,38B,86C 'stack-bas':37B,85C 'unauthent':9A,43B,92C 'version':61C,67C,73C,79C 'vulner':90C,101C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Dell PowerProtect Data Domain appliances on the affected release lines that have remote access enabled. Appliances outside the listed version ranges, or not reachable from untrusted networks, are less exposed. Whether the exposure depends on a non-default setting is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103780","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103780","severity":null,"published_at":"2026-10-28T11:17:14+00:00","modified_at":"2026-10-28T11:17:14+00:00","first_seen_at":"2026-10-28T11:32:27+00:00","fetched_at":"2026-10-28T11:32:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}