Dell DD OS Vulnerability: Certificate Login Elevation of Privilege

The National Vulnerability Database has identified CVE-2026-23776, a critical flaw in Dell PowerProtect Data Domain’s DD OS. Versions 7.7.1.0 through 8.5, along with specific LTS releases, are affected by an improper certificate validation issue in their certificate-based login mechanism. This vulnerability could allow a low-privileged attacker with remote access to escalate their privileges within the system.

This is a serious concern for organizations relying on Dell’s data protection solutions. The ability to bypass authentication and gain elevated access fundamentally undermines the security posture of backup and recovery systems. Attackers could potentially tamper with backups, delete data, or use the compromised system as a pivot point into the wider network.

Defenders must prioritize patching or mitigating this vulnerability immediately. Given the potential for privilege escalation, a thorough review of access controls and audit logs for certificate-based authentication on affected systems is warranted. Organizations should consult Dell’s security advisories for specific guidance and remediation steps.