Dell has published security advisory DSA-2026-416, which fixes 48 Dell-specific vulnerabilities in PowerProtect Data Domain and Data Domain Management Center. Four of the flaws score 9.8 on the CVSS 3.1 scale and require only network access, meaning an unauthenticated attacker could gain root command execution or create privileged accounts on a system that stores an organization’s backups.
What Advisory DSA-2026-416 Covers Across DD OS and Management Center
The advisory lists more than 180 CVEs in total and rates the overall impact as Critical. Dell’s own code accounts for 48 of them, and seven of those score 9.0 or higher. The remainder are third-party components bundled into the products, including Apache HTTP Server, Tomcat, nginx, OpenSSL, curl and BIND.
The affected products are Dell PowerProtect Data Domain, which runs the DD OS operating system, and the Data Domain Management Center. The source reporting does not describe any exploitation of these flaws.
The Four Unauthenticated CVSS 9.8 Vulnerabilities
The four 9.8 flaws share a profile: they need only network access and no credentials. According to the advisory summary, successful exploitation could let an attacker execute commands as root or create privileged accounts. Public coverage of the advisory does not tie individual CVE identifiers to these four, so the vulnerability type behind each is not detailed.
Management Center Flaws CVE-2026-103799, CVE-2026-103792 and CVE-2026-90717
Three further critical-range bugs affect Management Center. CVE-2026-103799 and CVE-2026-103792 both score 9.6 and combine missing authorization with SQL injection, and low-privileged users can reach them. CVE-2026-90717 scores 9.1 and is an authentication bypass affecting managed systems.
Lower in severity, the advisory also lists OS command injection CVE-2026-86396 and path traversal CVE-2026-86398, both rated 8.8 and exploitable through a low-privileged account, plus server-side request forgery CVE-2026-56084 at 5.8.
Why Data Domain Takeover Threatens Ransomware Recovery
Data Domain appliances store backup data, and that function raises the consequences of any compromise. Control of the system could allow an attacker to destroy or corrupt backup copies. If that happens before or during a ransomware attack, a victim organization loses the copies it would use to restore operations without paying.
Dell recommends upgrading to the fixed DD OS release for each software branch at the earliest opportunity. The advisory runs across multiple branches, so administrators must identify the specific fixed release that matches the branch they operate instead of assuming a single version number applies.
Backup Systems as Priority Targets in Ransomware Planning
The composition of this advisory reflects a broader pattern in enterprise security. Backup platforms have become a central objective in ransomware operations in recent years because eliminating recovery options increases pressure on victims. That makes unauthenticated, network-reachable flaws in such platforms more consequential than their CVSS scores alone convey.
A single advisory carrying more than 180 CVEs also creates a triage burden. Roughly three quarters of the entries come from third-party components, so patch teams must separate the Dell-specific critical items from library updates while still applying the full release. Dell directs administrators to the fixed DD OS release for their branch.
No evidence of attacks has been reported, which leaves a window in which administrators can patch before exploit code appears. Because the 9.8 flaws need only network access, how far a Data Domain system is exposed on the network decides how soon the risk becomes real.
The Management Center items deserve separate attention because they reach managed systems, not only the console itself. An authentication bypass such as CVE-2026-90717 on the management layer can extend an attacker’s reach to every appliance the console administers, while SQL injection combined with missing authorization, as in CVE-2026-103799 and CVE-2026-103792, needs only a low-privileged account. Dell’s advisory therefore covers both unauthenticated and low-privilege routes, and administrators who restrict the first still face the second.
