---
id: "CVE-2026-56084"
kind: "vulnerability"
aliases: ["CVE-2026-56084"]
title: "Dell PowerProtect Data Domain: unauthenticated server-side request forgery flaw"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["backup", "data-domain", "dell", "infrastructure", "powerprotect", "self-hosted"]
not_affected_if: ["no-remote-access", "unaffected-version"]
published_at: "2026-10-27T12:17:08+00:00"
first_seen_at: "2026-10-27T12:31:38+00:00"
updated_at: "2026-10-27T12:32:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56084", "first_seen_at": "2026-10-27T12:31:38+00:00"}]
---

# Dell PowerProtect Data Domain: unauthenticated server-side request forgery flaw

Several Dell PowerProtect Data Domain release lines contain a server-side request forgery flaw. An unauthenticated remote attacker could make the appliance send requests to internal or other destinations on its behalf.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Data Domain OS version against the affected ranges: Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20
- Confirm whether the appliance is reachable from untrusted networks (unknown from sources)

## Fix

- Move Data Domain OS to a fixed release for your line; the fixed version numbers are unknown from the sources, so check Dell's advisory
- Restrict management and network access to the appliance until patched

## Timeline

- 2026-10-27T12:31:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-56084

## From the sources

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_