CVE-2026-92665 in PowerProtect Data Domain
Summary
by MITRE • 10/28/2026
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Allocation of Resources Without Limits or Throttling vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The identified security flaw resides within Dell PowerProtect Data Domain systems across multiple software release tracks, specifically affecting Feature Release versions 7.7.1.0 through 8.8, LTS2024 releases from 7.13.1.0 to 7.13.1.80, LTS2025 releases ranging from 8.3.1.0 to 8.3.1.40, and LTS2026 versions spanning 8.6.1.0 to 8.6.1.20. This vulnerability is classified as an Allocation of Resources Without Limits or Throttling, a critical architectural weakness that allows for the exhaustion of system resources such as memory, CPU cycles, or network bandwidth without adequate constraints imposed by the application logic. The core technical issue stems from insufficient validation and rate-limiting mechanisms in components accessible to remote users, enabling malicious actors to trigger resource-intensive operations repeatedly or with disproportionately large payloads relative to available system capacity.
An unauthenticated attacker possessing valid remote access credentials can exploit this flaw to initiate a Denial of Service attack against the affected Data Domain appliance. By sending specially crafted requests that consume excessive computational resources or memory allocations without triggering internal throttling controls, an adversary can degrade the performance of critical backup and recovery services. This degradation may manifest as significant latency in data replication processes, timeouts during client connections, or complete unresponsiveness of the management interface. Since the vulnerability permits exploitation by unauthenticated users who have remote access, it implies that any user with network connectivity to the service endpoints but lacking proper authentication tokens can trigger this resource exhaustion, thereby bypassing standard identity verification protocols to impact system availability.
The operational impact of this vulnerability is severe for organizations relying on PowerProtect Data Domain for their data protection strategies. A successful exploitation results in a loss of availability, which directly contradicts the primary function of backup appliances that must remain accessible during disaster recovery scenarios or routine maintenance windows. If an attacker can render the system unresponsive, it prevents administrators from performing essential tasks such as initiating backups, verifying replication status, or restoring data. This creates a window of opportunity where critical business data remains unprotected and inaccessible, potentially leading to extended downtime in the event of actual hardware failure or ransomware incidents that require immediate restoration capabilities.
From a classification perspective, this vulnerability aligns with CWE-400, which describes conditions where resources are not properly limited, allowing for denial-of-service attacks through resource exhaustion. It also maps to MITRE ATT&CK techniques related to Resource Hijacking and Denial of Service, specifically those involving the abuse of system processes or services to degrade performance. The lack of input validation and rate limiting represents a fundamental design oversight in how the application handles external requests under varying load conditions.
To mitigate this risk, administrators should immediately apply the latest security patches provided by Dell for their specific version tier. Until patching is feasible, network-level controls such as firewall rules or access control lists should be implemented to restrict remote access to only trusted IP addresses and authorized management stations. Additionally, enabling strict rate limiting on public-facing interfaces and monitoring system resource utilization metrics can help detect anomalous activity indicative of an ongoing exploitation attempt. Regular auditing of user permissions ensures that unnecessary remote access privileges are revoked for accounts not requiring direct administrative interaction with the appliance core services.