CVE-2026-23775 Dell CVE debrief

Who should care

Defenders responsible for PowerProtect Data Domain appliances with DD OS Feature Release versions 8.0 through 8.5 and LTS2025 release version 8.3.1.0 through 8.3.1.10, especially those with retention lock enabled, should assess exposure and prioritize verification and potential updates.

Why it matters

Defenders should prioritize verifying exposure of PowerProtect Data Domain appliances with DD OS Feature Release versions 8.0 through 8.5 and LTS2025 release version 8.3.1.0 through 8.3.1.10, especially those with retention lock enabled, and assess the need for updates or compensating controls due to potential credential exposures and unauthorized access.

• Credential exposures due to insertion of sensitive information into log files
• Potential for low privileged attackers to gain unauthorized access
• Need for high privileged DD user authorization for authentication attempts
• Limited scope to systems with retention lock enabled

Technical summary

The vulnerability is an insertion of sensitive information into log file issue in Dell PowerProtect Data Domain appliances with Data Domain Operating System (DD OS) Feature Release versions 8.0 through 8.5 and LTS2025 release version 8.3.1.0 through 8.3.1.10. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to credential exposures. However, authentication attempts as the compromised user would need to be authorized by a high privileged DD user. This vulnerability only affects systems with retention lock enabled.

Defensive priority

Defenders should prioritize verifying exposure of PowerProtect Data Domain appliances with DD OS Feature Release versions 8.0 through 8.5 and LTS2025 release version 8.3.1.0 through 8.3.1.10, especially those with retention lock enabled, and assess the need for updates or compensating controls.

Recommended defensive actions

• Verify exposure of PowerProtect Data Domain appliances with DD OS Feature Release versions 8.0 through 8.5 and LTS2025 release version 8.3.1.0 through 8.3.1.10
• Assess the need for updates or patches according to vendor advisories
• Implement compensating controls for systems with retention lock enabled
• Monitor systems for potential credential exposures
• Review asset inventory for PowerProtect Data Domain appliances with DD OS Feature Release versions 8.0 through 8.5 and LTS2025 release version 8.3.1.0 through 8.3.1.10
• Track changes to system configurations and monitor for unauthorized access
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and potential impacts. However, the corpus does not establish specific exploitation instances or remediation steps beyond vendor advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.