CVE-2026-41123: Dell Data Domain Auth Bypass Vulnerability

CVE-2026-41123 Overview

CVE-2026-41123 is an improper access control vulnerability [CWE-284] affecting the Role-Based Access Control (RBAC) implementation in Dell PowerProtect Data Domain. The flaw allows a low-privileged authenticated attacker with remote network access to tamper with information beyond their assigned role permissions. Dell tracks this issue under advisory DSA-2026-278.

The vulnerability affects multiple release trains of the Dell Data Domain Operating System, including the mainline 7.7.1.0 through 8.6 branch and the LTS2024, LTS2025, and LTS2026 branches. Successful exploitation compromises data integrity within the backup appliance without requiring user interaction.

Critical Impact
An authenticated remote attacker with low privileges can bypass RBAC restrictions to tamper with data on the backup appliance, undermining the integrity of protected backups.

Affected Products

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.6
Dell PowerProtect Data Domain LTS2026 versions 8.6.1.0 through 8.6.1.10
Dell PowerProtect Data Domain LTS2025 versions 8.3.1.0 through 8.3.1.30
Dell PowerProtect Data Domain LTS2024 versions 7.13.1.0 through 7.13.1.70

Discovery Timeline

2026-07-03 - CVE-2026-41123 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-41123

Vulnerability Analysis

The vulnerability resides in the RBAC subsystem of the Dell Data Domain Operating System. RBAC governs which actions authenticated users can perform based on their assigned role, such as admin, user, security, or backup-operator. In affected releases, the access control checks do not correctly enforce role boundaries for certain operations.

An attacker authenticated with a low-privileged account can invoke functionality that should be restricted to higher-privileged roles. The impact is limited to integrity: the attacker can modify or tamper with information but cannot directly read sensitive data or cause a denial of service through this flaw. Because Data Domain appliances serve as the last line of defense for enterprise backup data, integrity tampering on these systems has downstream consequences for backup validity and ransomware recovery guarantees.

Root Cause

The root cause is missing or incorrect authorization enforcement within RBAC-protected code paths. The application authenticates the caller but does not consistently verify that the caller's role includes the specific permission required for the requested operation. This is a classic [CWE-284] Improper Access Control weakness.

Attack Vector

Exploitation requires network access to the Data Domain management interface and valid credentials for a low-privileged account. No user interaction is required, and attack complexity is low. An attacker sends authenticated requests to management endpoints that fail to validate role membership, allowing operations reserved for privileged roles.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.152%, indicating low likelihood of widespread exploitation activity at this time. See Dell Security Update DSA-2026-278 for vendor-supplied technical details.

Detection Methods for CVE-2026-41123

Indicators of Compromise

Unexpected configuration or data modifications on Data Domain appliances performed by non-administrative user accounts.
Authenticated API or CLI requests from low-privileged users invoking operations typically associated with the admin or security roles.
Audit log entries showing successful privileged actions attributed to accounts that should not possess those permissions.

Detection Strategies

Enable and centralize Data Domain audit logging, then baseline which operations each role legitimately performs.
Alert on deviations where low-privileged accounts execute integrity-affecting commands such as configuration changes, retention modifications, or file operations outside their scope.
Correlate management-plane authentication events with subsequent privileged operations to detect role-boundary violations.

Monitoring Recommendations

Forward Data Domain syslog and audit events to a centralized SIEM for retention and correlation.
Review RBAC role assignments regularly and remove unused or over-privileged low-tier accounts.
Monitor management interface traffic for anomalous volumes of authenticated requests from a single low-privileged session.

How to Mitigate CVE-2026-41123

Immediate Actions Required

Identify all Dell PowerProtect Data Domain appliances in scope and confirm their release train and version against the affected list.
Apply the vendor-supplied patch referenced in DSA-2026-278 during the next available maintenance window.
Rotate credentials for low-privileged Data Domain user accounts and review recent audit logs for suspicious activity.

Patch Information

Dell has published fixed releases through advisory DSA-2026-278. Administrators should upgrade to a fixed version within their maintained release train: LTS2024 later than 7.13.1.70, LTS2025 later than 8.3.1.30, LTS2026 later than 8.6.1.10, or the mainline release above 8.6. Refer to Dell Security Update DSA-2026-278 for the exact fixed versions and upgrade procedures.

Workarounds

Restrict network access to the Data Domain management interface to trusted administrative subnets and jump hosts only.
Reduce the number of low-privileged accounts and enforce strong authentication with unique credentials per user.
Enable and monitor comprehensive audit logging until the patch is applied to shorten time-to-detect for any exploitation attempts.

bash

# Example: restrict Data Domain management access to an admin subnet
# (verify exact syntax against your Data Domain OS version)
net filter add seq 10 proto tcp dport 22 src-ip 10.10.5.0/24 action allow
net filter add seq 20 proto tcp dport 443 src-ip 10.10.5.0/24 action allow
net filter add seq 900 action deny
net filter enable