VDB
CVE-2026-26951
CVE-2026-26951
PUBLISHED
CVSS 6.7 MEDIUM
Reported by dell · Published April 20, 2026
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain a stack-based buffer overflow vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| powerprotect_dp_series_appliance | dell | 2.7.9 |
| data_domain_operating_system | dell | 8.6.1.0, 8.3.1.30, 7.13.1.70 |
| PowerProtect Data Domain | Dell | 8.6.1.10, 8.7.0.0 or later, 8.3.1.30 or later, 7.13.1.70 or later, 2.7.9 with DD OS 8.3.1.30 |
Risk scores
CVSS 3.1
6.7
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Dell | PowerProtect Data Domain | 0, 0, 0 |
| Dell | PowerProtect Data Domain | 0, 0, 0 |
Timeline
- Apr 14, 2026 CVE Published
- Apr 21, 2026 Security Advisory (5 in total, the first dated here)
- May 18, 2026 EPSS Score (25 in total, the first dated here)
- Jul 12, 2026 Coalition ESS Score
- Aug 5, 2026 CVE Updated
- Aug 11, 2026 Distribution Patch (4 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-26951
vulnetix vdb fixes CVE-2026-26951Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-26951/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart