{"id":"CVE-2026-68866","kind":"vulnerability","aliases":["CVE-2026-68866"],"related":[],"title":"Dell PowerProtect Data Domain: path traversal in certificate handling enables denial of service","description":"PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Relative Path Traversal vulnerability in the certificate. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.","summary":"Dell PowerProtect Data Domain appliances contain a relative path traversal flaw in the certificate handling code. A highly privileged remote attacker could exploit it to cause a denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup-appliance","data-domain","dell","infrastructure","powerprotect"],"not_affected_if":["admin-access-restricted"],"how_to_check":"- Check the installed DD OS version on the appliance and compare it against the affected ranges: 7.7.1.0 through 8.7, 7.13.1.0 through 7.13.1.70, 8.3.1.0 through 8.3.1.30, and 8.6.1.0 through 8.6.1.10\n- unknown for any other check, the sources do not say","fix":"- Move to a fixed DD OS release for your release line; the specific fixed versions are unknown from the sources, so check the vendor advisory","status":"open","published_at":"2026-10-27T14:17:01+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","triaged_at":"2026-10-27T14:33:07+00:00","updated_at":"2026-10-27T14:33:07+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T14:33:07Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed DD OS release for your release line; the specific fixed versions are unknown from the sources, so check the vendor advisory","reach":"network","title":"Dell PowerProtect Data Domain: path traversal in certificate handling enables denial of service","impact":"low","summary":"Dell PowerProtect Data Domain appliances contain a relative path traversal flaw in the certificate handling code. A highly privileged remote attacker could exploit it to cause a denial of service.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with high privileges crashes the appliance service remotely","analyst_note":"Find the Dell security advisory for the fixed DD OS versions per release line; the NVD entry does not list them.","how_to_check":"- Check the installed DD OS version on the appliance and compare it against the affected ranges: 7.7.1.0 through 8.7, 7.13.1.0 through 7.13.1.70, 8.3.1.0 through 8.3.1.30, and 8.6.1.0 through 8.6.1.10\n- unknown for any other check, the sources do not say","needs_analyst":true,"not_affected_if":["admin-access-restricted"],"who_is_affected":"Organizations running Dell PowerProtect Data Domain appliances on the listed DD OS release ranges with remote administrative access enabled. Only highly privileged accounts can exploit it, so systems with tightly restricted administrator access carry less practical risk. Appliances on other versions are not affected according to the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000643,"input_tokens":3410,"output_tokens":604,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-68866':16A,19A '7.13.1.0':71C '7.13.1.70':73C '7.7.1.0':65C '8.3.1.0':77C '8.3.1.30':79C '8.6.1.0':83C '8.6.1.10':85C '8.7':67C 'access':101C 'applianc':22B,33B 'attack':49B,98C 'backup':21B 'backup-appli':20B 'caus':54B 'certif':8A,42B,94C 'code':44B 'contain':34B,86C 'could':50B,102C 'cve':14A,17A 'data':3A,24B,31B,60C 'data-domain':23B 'dell':1A,26B,29B 'denial':11A,56B,109C 'domain':4A,25B,32B,61C 'enabl':10A 'exploit':51B,104C 'featur':62C 'flaw':39B 'handl':9A,43B 'high':46B,96C 'infrastructur':27B 'lead':107C 'lts2024':68C 'lts2025':74C 'lts2026':80C 'path':5A,37B,89C 'potenti':103C 'powerprotect':2A,28B,30B,59C 'privileg':47B,97C 'relat':36B,88C 'releas':63C,69C,75C,81C 'remot':48B,100C 'servic':13A,58B,111C 'travers':6A,38B,90C 'version':64C,70C,76C,82C 'vulner':91C,106C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Dell PowerProtect Data Domain appliances on the listed DD OS release ranges with remote administrative access enabled. Only highly privileged accounts can exploit it, so systems with tightly restricted administrator access carry less practical risk. Appliances on other versions are not affected according to the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:17:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68866","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68866","severity":null,"published_at":"2026-10-27T14:17:01+00:00","modified_at":"2026-10-27T14:17:01+00:00","first_seen_at":"2026-10-27T14:32:25+00:00","fetched_at":"2026-10-27T14:32:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}