CVE-2026-68866

MediumCVSS 6.5/10Last modified Oct 29, 2026

Description

PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Relative Path Traversal vulnerability in the certificate. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-23

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Dell	PowerProtect Data Domain	< 8.9.0.0 or later; < 7.13.1.80 or later; < 8.3.1.40 or later; < 8.6.1.20 or later

References

https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities

Timeline

Published: Oct 27, 2026
Last modified: Oct 29, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-688686.5The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections CVE-2026-68879.8Borg SPM 2007 (Sales Ended in 2008) developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing unauthenticated rem CVE-2026-688705.3The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through th CVE-2026-688716.5The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agn CVE-2026-688726.5The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection o CVE-2026-688735.5Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclos CVE-2026-688745.7Out-of-bounds read in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information over a network.CVE-2026-688757.8Buffer over-read in Windows NTFS allows an authorized attacker to execute code locally.CVE-2026-688768.0Heap-based buffer overflow in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges over a net CVE-2026-688777.8Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to execute code locally.CVE-2026-688788.0Stack-based buffer overflow in Windows Fast FAT Driver allows an authorized attacker to elevate privileges over a network.CVE-2026-68887.2Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to execute arbitrary commands via a s