{"id":"CVE-2026-92665","kind":"vulnerability","aliases":["CVE-2026-92665"],"related":[],"title":"Dell PowerProtect Data Domain: unauthenticated remote request can cause denial of service","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Allocation of Resources Without Limits or Throttling vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.","summary":"Several Dell PowerProtect Data Domain release lines allocate resources without limits or throttling. An unauthenticated remote attacker can exhaust resources and cause a denial of service.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup-appliance","data-domain","dell","infrastructure","powerprotect"],"not_affected_if":["not-network-reachable","version-outside-affected-ranges"],"how_to_check":"- Check the installed Data Domain OS version against the affected ranges: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20\n- Confirm whether the management or service interface is reachable from untrusted networks (unknown from sources)","fix":"- Move Data Domain OS to a fixed release from Dell's advisory for the affected line (exact fixed versions unknown from sources)\n- Restrict network access to the Data Domain management interface until patched","status":"open","published_at":"2026-10-28T10:17:11+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","triaged_at":"2026-10-28T10:34:33+00:00","updated_at":"2026-10-28T10:34:33+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T10:34:33Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain OS to a fixed release from Dell's advisory for the affected line (exact fixed versions unknown from sources)\n- Restrict network access to the Data Domain management interface until patched","reach":"internet","title":"Dell PowerProtect Data Domain: unauthenticated remote request can cause denial of service","impact":"low","summary":"Several Dell PowerProtect Data Domain release lines allocate resources without limits or throttling. An unauthenticated remote attacker can exhaust resources and cause a denial of service.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup-appliance"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker exhausts resources and takes the appliance offline","analyst_note":"Check Dell's security advisory for the fixed versions per release line and the exact service affected.","how_to_check":"- Check the installed Data Domain OS version against the affected ranges: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20\n- Confirm whether the management or service interface is reachable from untrusted networks (unknown from sources)","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges","not-network-reachable"],"who_is_affected":"Organizations running Dell PowerProtect Data Domain systems on the affected OS release lines. The sources do not say which service is reached by the unauthenticated request, so exposure depends on whether the appliance is reachable from untrusted networks. Systems on versions outside the listed ranges are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000668,"input_tokens":3420,"output_tokens":651,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-92665':15A,18A '7.13.1.0':67C '7.13.1.80':69C '7.7.1.0':61C '8.3.1.0':73C '8.3.1.40':75C '8.6.1.0':79C '8.6.1.20':81C '8.8':63C 'access':97C 'alloc':35B,84C 'applianc':21B 'attack':44B,94C 'backup':20B 'backup-appli':19B 'caus':9A,49B 'contain':82C 'could':98C 'cve':13A,16A 'data':3A,23B,31B,56C 'data-domain':22B 'dell':1A,25B,29B,54C 'denial':10A,51B,105C 'domain':4A,24B,32B,57C 'exhaust':46B 'exploit':100C 'featur':58C 'infrastructur':26B 'lead':103C 'limit':38B,88C 'line':34B 'lts2024':64C 'lts2025':70C 'lts2026':76C 'potenti':99C 'powerprotect':2A,27B,30B,55C 'releas':33B,59C,65C,71C,77C 'remot':6A,43B,96C 'request':7A 'resourc':36B,47B,86C 'servic':12A,53B,107C 'sever':28B 'throttl':40B,90C 'unauthent':5A,42B,93C 'version':60C,66C,72C,78C 'vulner':91C,102C 'without':37B,87C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Dell PowerProtect Data Domain systems on the affected OS release lines. The sources do not say which service is reached by the unauthenticated request, so exposure depends on whether the appliance is reachable from untrusted networks. Systems on versions outside the listed ranges are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T10:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92665","severity":null,"published_at":"2026-10-28T10:17:11+00:00","modified_at":"2026-10-28T10:17:11+00:00","first_seen_at":"2026-10-28T10:32:15+00:00","fetched_at":"2026-10-28T10:32:15+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}