Article
Dell Data Domain: Seven Critical Flaws and the Build Each Release Line Needs
Dell's DSA-2026-416 lists seven critical PowerProtect Data Domain flaws, four needing no login. See the fixed DD OS build for each release line.
Read more
Vulnerability
Dell PowerProtect Data Domain stack-based buffer overflow (CVE-2026-103780)
A stack-based buffer overflow in Dell PowerProtect Data Domain.
- CVE ID
- CVE-2026-103780
- CVSS
- 9.8 Critical (CVSS 3.1, Dell as CNA)
- Affected product
- PowerProtect Data Domain, Data Domain Virtual Edition and APEX Protection Storage (DD OS)
- Exploited
- Unknown
- Published
- 28 October 2026 (CVE record); added to Dell advisory DSA-2026-416 on 19 October 2026
In short
CVE-2026-103780 is a stack-based buffer overflow in Dell PowerProtect Data Domain. Dell says an unauthenticated attacker with remote access could potentially run commands. It is rated 9.8, was added to Dell's advisory on 19 October 2026 and is fixed in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30.
- CVECVE-2026-103780
- ProductDell PowerProtect Data Domain, Data Domain Virtual Edition and APEX Protection Storage (DD OS)
- Fix Steps5actions listedFind your builds · Upgrade
What it allows
Dell describes CVE-2026-103780 as a stack-based buffer overflow. An unauthenticated attacker with remote access could potentially exploit it, leading to command execution. Dell, as CNA, scores it 9.8 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The CVE record lists CWE-121, Stack-based Buffer Overflow. It is the only memory-corruption flaw among the seven critical flaws in Dell's own code.
Added Later Than the Others
Dell's revision history shows that revision 3.0, dated 19 October 2026, added CVE-2026-103780 together with five other CVEs. The advisory itself was first released on 1 October 2026. The CVE record followed on 28 October at 10:14 UTC.
What Dell Does Not Say
Dell does not name the service or the input that triggers the overflow, and it does not say how reliably it can be exploited. The word "potentially" in Dell's text is Dell's own. The advisory describes no exploitation and lists no workaround.
Other Memory Flaws in the Same Advisory
Dell lists lower-rated memory flaws too. CVE-2026-86378 is a stack-based buffer overflow rated 8.8 for a low-privileged attacker, and CVE-2026-86377 is an out-of-bounds write rated 7.6 that leads to denial of service. They share the four fixed builds of this flaw.
Who is affected
Dell's remediation table lists Data Domain series appliances, Data Domain Virtual Edition and Dell APEX Protection Storage with DD OS, and Data Domain Management Center, as affected. Dell lists DD OS 7.7.1.0 through 8.8.0.0 on the Feature Release line, 7.13.1.0 through 7.13.1.80 on LTS2024, 8.3.1.0 through 8.3.1.40 on LTS2025 and 8.6.1.0 through 8.6.1.20 on LTS2026.
Dell fixed the flaw in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30. Each fix applies from that build onward. Dell's table starts at 7.7.1.0 and does not say whether older DD OS releases are affected.
Dell groups this flaw with the others of advisory DSA-2026-416, which our post covers by release line.
The same advisory has six more critical flaws with their own pages.
Timeline
- 1 Oct 2026
Dell publishes DSA-2026-416; its revision history shows this date as the initial release.
- 19 Oct 2026
Revision 3.0 of the advisory adds CVE-2026-103780 and five other CVEs to its tables of Dell's own code and of affected products.
- 27 Oct 2026
The CISA Known Exploited Vulnerabilities catalog release of this date does not list the flaw.
- 28 Oct 2026
Dell, as CNA, publishes the CVE record at 10:14 UTC with the score of 9.8 and the fixed builds.
What to do
-
Find your builds
List every Data Domain system with its DD OS build, including virtual editions and APEX Protection Storage.
-
Upgrade
Move to 8.9.0.0, 7.13.1.90, 8.3.1.50 or 8.6.1.30, or later. The advisory lists no workaround.
-
Check the revision you used
If you planned your patch from the advisory before 19 October 2026, read revision 3.0 again. This flaw was added in that revision.
-
Limit network reach
Open management access only to an admin network. This is hardening, not a Dell workaround, and Dell does not say which service the overflow is in.
-
Keep a separate copy
Keep critical backups in a copy that Data Domain administrators cannot change, as on our immutable backup page.
Questions
Which DD OS builds fix CVE-2026-103780?
DD OS 8.9.0.0 or later on the Feature Release line, 7.13.1.90 or later on LTS2024, 8.3.1.50 or later on LTS2025 and 8.6.1.30 or later on LTS2026.
Is CVE-2026-103780 exploited?
Dell's advisory describes no exploitation, and the CISA KEV catalog release of 27 October 2026 does not list the flaw.
Does CVE-2026-103780 need a login?
No. Dell describes an unauthenticated attacker with remote access.
When did Dell add CVE-2026-103780 to the advisory?
Revision 3.0 of DSA-2026-416, dated 19 October 2026, added it with five other CVEs.
Who scored CVE-2026-103780 9.8?
Dell, as the CNA, in the CVE record it published on 28 October 2026 at 10:14 UTC.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 59 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 90 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.