CVE-2026-73600: Dell PowerProtect Data Manager Stack Buffer Overflow

Overview

Dell has disclosed CVE-2026-73600, a stack-based buffer overflow (CWE-121) affecting the file-level restore agent in PowerProtect Data Manager, versions 20.2.0.0 and earlier. The flaw was published to the CVE database on September 3, 2026, and is documented in Dell's advisory DSA-2026-368, which also covers three related vulnerabilities in the same product line.

PowerProtect Data Manager is Dell's enterprise data-protection and backup orchestration platform, widely deployed to manage backup, recovery, and disaster-recovery workflows for virtual machines, databases, and file systems. A flaw in its restore agent puts organizations' backup infrastructure — often the last line of defense against ransomware — directly in the blast radius.

Technical Details

How It Works

Dell's advisory describes the issue as a buffer overflow triggered while the file-level restore agent handles platform language code (PlatformLangCodes) input. The CVSS vector indicates the attack vector is local (AV:L) and requires low privileges (PR:L) with no user interaction — meaning an attacker needs some level of existing access to the host running the restore agent to trigger the overflow. Successful exploitation carries a high impact across confidentiality, integrity, and availability, and Dell's summary describes the primary consequence as information disclosure.

Other Vulnerabilities in DSA-2026-368

Dell's advisory bundles four vulnerabilities affecting the same PowerProtect Data Manager versions, all remediated in the 20.3.0.0 release:

Impact Assessment

Who Is At Risk

Any organization running PowerProtect Data Manager 20.2.0.0 or earlier is affected. Because the restore agent typically runs with elevated access to backup data and connected storage targets, a successful exploit could expose sensitive information contained in backup catalogs or restore workflows — an especially damaging outcome for organizations that rely on PowerProtect as part of their ransomware-recovery strategy.

Attack Prerequisites

• Existing local or low-privileged access to a system running the affected restore agent
• No user interaction required once that access is established

Mitigation

Immediate Actions

• Upgrade to PowerProtect Data Manager 20.3.0.0, which remediates all four vulnerabilities disclosed in DSA-2026-368
• Review access controls on hosts running the file-level restore agent to limit who can reach it locally
• Audit backup infrastructure logs for unexpected restore-agent crashes or anomalous behavior consistent with overflow exploitation attempts

Defence-in-Depth

• Restrict administrative and local access to backup management infrastructure to a minimal set of trusted operators
• Keep backup software on a supported, current release track — backup platforms are increasingly targeted as part of ransomware kill chains
• Monitor Dell Security Advisories for follow-up guidance on this product line

References

• Dell DSA-2026-368: Security Update for Dell PowerProtect Data Manager Multiple Vulnerabilities
• NVD — CVE-2026-73600