CVE-2026-41122: Dell PowerProtect Data Domain Stored XSS Vulnerability

Technical summary

CVE-2026-41122 is a stored XSS vulnerability (CWE-79) in Dell PowerProtect Data Domain's web interface. The vulnerability stems from insufficient input validation and output encoding of user-supplied data, allowing an attacker to persist malicious JavaScript payloads in the application database. These payloads execute in the context of authenticated users' browsers when they view affected pages. The attack requires no authentication to inject the payload but does require user interaction to trigger exploitation. The CVSS 3.1 score of 7.1 reflects the network-accessible vector, low complexity, and the potential for confidentiality, integrity, and availability impacts through client-side compromise.

Business impact

Successful exploitation could lead to unauthorized access to backup and deduplication data managed by Data Domain systems, which often contain sensitive corporate and customer information. Session hijacking could grant attackers administrative control over backup operations, potentially enabling data exfiltration, ransomware staging, or destruction of backup copies. In environments where Data Domain is critical to business continuity and disaster recovery, compromise of these systems creates cascading risk to organizational resilience. Compromised backups lose their integrity as trusted recovery points.

Affected systems

Dell PowerProtect Data Domain versions vulnerable include: 7.7.1.0 through 8.7 (general release), 8.6.1.0 through 8.6.1.10 (LTS2026), 8.3.1.0 through 8.3.1.30 (LTS2025), and 7.13.1.0 through 7.13.1.70 (LTS2024). Organizations running any version within these ranges should verify their current Data Domain software version and consult Dell's patch advisories for applicable updates.

Exploitability

Exploitation is moderately straightforward. The attacker must craft a payload and inject it through an unauthenticated vector in the web interface, then socially engineer or wait for an authorized administrator to interact with the malicious content. No authentication is required to perform the injection, lowering the barrier to exploitation. However, the UI requirement means the attack depends on user action rather than being fully automatic. The attack surface includes any input fields or data elements reflected or stored without proper sanitization. This vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Immediate patching is strongly recommended given the sensitivity of data protected by Data Domain systems. Organizations should obtain and apply vendor patches for their specific release branch—verify against Dell's security advisory for the exact patch version applicable to your installation. Until patching is complete, network segmentation to restrict administrative access to Data Domain interfaces from untrusted networks provides temporary risk reduction. Additionally, disable web interface access for users who do not require it, and enforce multi-factor authentication for all administrative accounts to limit session hijacking impact.

Patch guidance

Contact Dell for the specific patch version corresponding to your Data Domain release line and version. The vulnerability affects broad version ranges; Dell has released patches for multiple tracks (general release, LTS2026, LTS2025, LTS2024). Download patches only from Dell's official support portal or security advisory pages. Test patches in a non-production environment mirroring your deployment before applying to production backup systems. Coordinate patching windows to avoid disrupting backup and recovery operations. Verify remediation by reviewing release notes to confirm the XSS issue is addressed.

Detection guidance

Monitor Data Domain web interface logs for suspicious input patterns, particularly encoded JavaScript, script tags, or event handlers in request parameters and form submissions. Search for payloads containing 'script', 'onerror', 'onload', 'onclick', or similar XSS indicators in HTTP POST and GET parameters. Inspect administrator session logs for unexpected access times or geographic origins. Review browser-based audit logs for console errors or warnings that might indicate injected script execution. Consider deploying a Web Application Firewall (WAF) in front of Data Domain interfaces to detect and block common XSS payloads. Enable verbose logging on the Data Domain web service and correlate access patterns with known administrator activity to identify anomalies.

Why prioritize this

Prioritize this vulnerability HIGH because Data Domain systems are critical infrastructure protecting organizational data and recovery capability. The combination of unauthenticated injection capability, stored persistence, and potential for administrative session hijacking makes this a direct path to major business impact. Backup system compromise is particularly damaging because it undermines the last line of defense in incident response. The CVSS 7.1 HIGH rating, cross-site scope, and confidentiality/integrity/availability impacts align with vulnerability prioritization best practices for systems handling sensitive data.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects: AV:N (remotely exploitable over the network), AC:L (no complex conditions required for exploitation), PR:N (no authentication needed to inject), UI:R (requires user interaction to trigger), S:C (crosses trust boundaries to affect other users), and C:L/I:L/A:L (impacts confidentiality, integrity, and availability). The score appropriately captures a serious vulnerability in a critical infrastructure component, though the UI requirement prevents it from reaching the 8.0+ critical threshold. Organizations managing backup systems should treat this as critical operationally even though the numeric CVSS falls in the HIGH range.

Frequently asked questions