CVE-2026-41123: Dell PowerProtect Data Domain RBAC Access Control Vulnerability

Technical summary

CVE-2026-41123 is an improper access control vulnerability (CWE-284) affecting Dell PowerProtect Data Domain's RBAC implementation. The vulnerability permits authenticated users with low privilege levels to perform unauthorized modifications to protected data or configurations. The CVSS 3.1 score of 4.3 reflects a network-accessible attack requiring valid credentials, with limited impact scope (integrity only, no confidentiality or availability compromise). The flaw spans multiple release branches: standard versions 7.7.1.0–8.6, LTS2026 8.6.1.0–8.6.1.10, LTS2025 8.3.1.0–8.3.1.30, and LTS2024 7.13.1.0–7.13.1.70.

Business impact

For organizations relying on Data Domain for backup and deduplication, this vulnerability introduces data integrity risk. An insider or compromised account with basic system access could alter backup metadata, restore points, or configuration parameters without proper authorization. While the attack requires network access and valid credentials, the impact is particularly concerning because: (1) Data Domain is often trusted as a recovery system; (2) integrity tampering might not be immediately visible in logs; (3) corrupted or altered backups could undermine recovery objectives during an actual incident response.

Affected systems

Dell PowerProtect Data Domain operating system versions 7.7.1.0 through 8.6, plus all three LTS branches (LTS2024, LTS2025, LTS2026) are affected. Organizations should verify their exact Data Domain firmware version in the system dashboard or via CLI to determine exposure. This covers both current-release and long-term-support tracks, so both modernly-updated and stability-focused deployments require attention.

Exploitability

Exploitation requires valid user credentials and network access to the Data Domain management interface. The attack complexity is low—no special conditions or race conditions are needed once authenticated. However, the requirement for pre-existing access substantially reduces the likelihood of remote, unauthenticated exploitation. The vulnerability does not appear in the CISA KEV catalog, indicating no evidence of active exploitation in the wild as of the publication date. Organizations should still prioritize remediation for environments where user account hygiene is loose or where service accounts have overly broad permissions.

Remediation

Dell has issued patches across all affected release branches. Organizations should apply vendor-supplied firmware updates immediately upon availability, which will address the RBAC control gaps. Interim mitigations include: (1) restricting network access to Data Domain management interfaces via firewall rules; (2) auditing RBAC role assignments and reducing privileges to only what is necessary; (3) enabling and monitoring Data Domain audit logs for suspicious data modifications; (4) implementing multi-factor authentication for administrative access if supported by your Data Domain version.

Patch guidance

Check Dell's security advisories and Data Domain release notes for patched firmware versions corresponding to your current release branch. Patches are expected for versions 7.7.1.0–8.6, LTS2024 (7.13.1.x), LTS2025 (8.3.1.x), and LTS2026 (8.6.1.x). Verify against the vendor advisory the exact patched version number for your branch before upgrading. Data Domain firmware updates typically require a maintenance window; coordinate with backup operations teams to ensure no active backup jobs are running during the patch. Test the patched version in a non-production environment if possible to confirm no regression in deduplication or replication functionality.

Detection guidance

Monitor Data Domain audit logs for unauthorized modification attempts or privilege escalation indicators. Look for: (1) low-privileged users performing administrative-level data modifications; (2) unexpected changes to backup metadata, retention policies, or configuration parameters; (3) role or permission changes that do not correspond to documented administrative actions. Enable verbose logging for RBAC-related events if available. Correlate Data Domain audit events with authentication logs and user provisioning systems to identify anomalous account behavior. Periodic integrity checks on critical backup metadata and restore-point validity can help detect tampering after the fact.

Why prioritize this

Although the CVSS score is moderate (4.3) and no active exploitation is documented, this vulnerability affects a critical system type—backup infrastructure. Data integrity breaches are often discovered late, and corrupted backups can render a critical recovery mechanism ineffective during a security incident. The requirement for authentication limits rapid spread, but the integrity impact justifies prompt attention. Organizations with robust backup governance and strong RBAC hygiene can schedule patching within standard maintenance windows; those with looser access controls or where Data Domain is internet-facing should prioritize higher.

Risk score, explained

The CVSS 3.1 base score of 4.3 (MEDIUM) reflects the vulnerability's limited attack surface: network accessible but requiring authenticated access (PR:L), low attack complexity, and integrity impact only. The score does not account for the asset criticality (backup systems are high-value targets) or the difficulty of detecting tampering retroactively. For environments where data integrity is paramount or where user account proliferation is high, internal risk models should consider elevating the priority above the base CVSS score.

Frequently asked questions