---
id: "CVE-2026-68866"
kind: "vulnerability"
aliases: ["CVE-2026-68866"]
title: "Dell PowerProtect Data Domain: path traversal in certificate handling enables denial of service"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["backup-appliance", "data-domain", "dell", "infrastructure", "powerprotect"]
not_affected_if: ["admin-access-restricted"]
published_at: "2026-10-27T14:17:01+00:00"
first_seen_at: "2026-10-27T14:32:25+00:00"
updated_at: "2026-10-27T14:33:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68866", "first_seen_at": "2026-10-27T14:32:25+00:00"}]
---

# Dell PowerProtect Data Domain: path traversal in certificate handling enables denial of service

Dell PowerProtect Data Domain appliances contain a relative path traversal flaw in the certificate handling code. A highly privileged remote attacker could exploit it to cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed DD OS version on the appliance and compare it against the affected ranges: 7.7.1.0 through 8.7, 7.13.1.0 through 7.13.1.70, 8.3.1.0 through 8.3.1.30, and 8.6.1.0 through 8.6.1.10
- unknown for any other check, the sources do not say

## Fix

- Move to a fixed DD OS release for your release line; the specific fixed versions are unknown from the sources, so check the vendor advisory

## Timeline

- 2026-10-27T14:32:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-68866

## From the sources

PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Relative Path Traversal vulnerability in the certificate. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_