CVE-2026-26354 is a high severity (CVSS 8.1) stack based buffer overflow in Dell PowerProtect Data Domain running DD OS. An unauthenticated attacker with remote access could potentially run arbitrary commands. Dell covers it in DSA-2026-060. Check that advisory for the fixed release for your train and update.
What's affected
The NVD record lists these DD OS releases as affected:
- Feature Release versions 7.7.1.0 through 8.6
- LTS2025 release versions 8.3.1.0 through 8.3.1.10
- LTS2024 release versions 7.13.1.0 through 7.13.1.60
The products named are Dell Data Domain Operating System and the PowerProtect DP Series appliance.
We could not load Dell's advisory page, which blocked automated access, so we cannot quote the fixed releases. Open Dell security advisory DSA-2026-060 for the exact fixed version on each release train.
How to check if you're exposed
On the appliance, check the DD OS version from the command line:
system show version
Compare the result with the three ranges above. Your release train matters: a system on the LTS2024 line is checked against 7.13.1.0 to 7.13.1.60, a system on LTS2025 against 8.3.1.0 to 8.3.1.10.
Then check which networks can reach the appliance. A backup system that answers on a general purpose network is more exposed than one on a dedicated backup or management segment.
What to do now
- Open Dell advisory DSA-2026-060 and find the fixed release for your train.
- Schedule the DD OS update in a maintenance window and confirm the version afterwards.
- Restrict access to the appliance's management and service ports to the backup and administration networks only.
- Review recent logins and system events on the appliance, and make sure alerts reach your monitoring team.
- Confirm that your backups are intact and that you have a recent copy offline, before and after the upgrade.
Why it matters
The weaknesses are CWE-121, stack based buffer overflow, and CWE-787, out of bounds write. A program copies more data into a fixed stack buffer than it holds, and the excess overwrites nearby memory, which in the worst case lets an attacker redirect what the program runs.
The vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. It is network reachable with no login, but attack complexity is rated high, which keeps the score at 8.1. Dell says an unauthenticated attacker with remote access could potentially achieve arbitrary command execution.
The record is not on the CISA Known Exploited Vulnerabilities list, and we found no statement of exploitation.
Backup systems deserve more attention than they usually get. They hold copies of everything and are a common target when attackers want to stop recovery.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the fixed version of DD OS for CVE-2026-26354?
We could not load Dell's advisory. Open DSA-2026-060 for the fixed release on your train.
Is login required to exploit it?
The record says an unauthenticated attacker with remote access could potentially exploit it.
Sources
- Dell advisory DSA-2026-060 (cited by the record; blocked automated access, so details here come from the NVD record)
- NVD record for CVE-2026-26354
Last reviewed: 19 October 2026.
