Dell has recently disclosed two critical vulnerabilities in PowerProtect Data Domain appliances that could allow unauthenticated remote attackers to gain complete control of affected systems.
These vulnerabilities are tracked as CVE-2026-53483 and CVE-2026-53481, both of which received a critical CVSS v3.1 score of 9.8. They affect multiple supported Data Domain software versions, including those from 7.7.1.0 to 8.7.8.7.
Dell Warns of Critical PowerProtect Data Domain Flaws
The significance of these vulnerabilities lies in the fact that they require no authentication, user interaction, or complex attack conditions.
Both vulnerabilities exhibit the following CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that an attacker can exploit them remotely over a network with low attack complexity.
A successful attack could compromise the confidentiality, integrity, and availability of enterprise backup environments.
CVE-2026-53483 is classified as an improper authentication vulnerability. Dell stated that an unauthenticated attacker with remote access could exploit this issue to gain unauthorized access to a vulnerable PowerProtect Data Domain system.
Due to the potential for complete system takeover, organizations that expose management or appliance services to untrusted networks must prioritize remediation.
The second flaw, CVE-2026-53481, is a path traversal vulnerability resulting from improper limitation of a pathname to a restricted directory.
Such vulnerabilities can allow an attacker to manipulate file paths and access files or directories outside of the intended structure. In the case of Data Domain, Dell warned that a remote, unauthenticated attacker could leverage this issue to gain unauthorized access and ultimately take complete control of the appliance.
Affected versions include standard PowerProtect Data Domain releases from 7.7.1.0 to 8.7.8.7, as well as several long-term support (LTS) branches.
The impacted LTS2026 versions range from 8.6.1.0 to 8.6.1.10; LTS2025 versions from 8.3.1.0 to 8.3.1.30; and LTS2024 versions from 7.13.1.0 to 7.13.1.70. Administrators should review their deployed software versions and consult Dell’s security guidance to identify the appropriate updates.
PowerProtect Data Domain appliances are commonly used to store, deduplicate, protect, and recover backup data. Their critical role makes them attractive targets for ransomware operators, who often aim to compromise or destroy backups to prevent victims from restoring encrypted systems.
Complete compromise of an appliance could allow attackers to access sensitive backup contents, alter retention settings, disrupt recovery operations, or remove recovery data before launching a wider extortion attack.
Dell recommends that customers upgrade affected appliances as soon as possible. Until patches can be applied, security teams should ensure that Data Domain management interfaces are not directly exposed to the internet.
They should implement network segmentation and allowlists, enforce monitoring of administrative activities, and review authentication and access logs for any anomalous activity. Organizations should also validate the integrity and recoverability of backup data, as the backup infrastructure is a high-value target during contemporary ransomware attacks.
Gain browser-level visibility to expose decrypted phishing pages, speed investigations, and cut credential theft costs -> Power your SOC with ANY.RUN
