#Dell
All CosmicBytez Labs articles tagged #Dell, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-86384: Dell PowerProtect Data Domain Hard-Coded Cryptographic Key (CVSS 9.8)
A hard-coded cryptographic key in Dell PowerProtect Data Domain lets an unauthenticated attacker compromise the appliance. CVSS 9.8; upgrade DD OS now.
- Security
CVE-2026-86397: Dell PowerProtect Data Domain Improper Authentication Flaw (CVSS 9.8)
An unauthenticated network attacker can abuse an authentication flaw in Dell PowerProtect Data Domain. Fixed in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50, 8.6.1.30.
- Security
CVE-2026-86400: Dell PowerProtect Data Domain Auth Flaw Enables Unauthenticated Root Command Execution
CVE-2026-86400 (CVSS 9.8) lets an unauthenticated attacker bypass controls on Dell Data Domain and run commands as root. Upgrade to a fixed DD OS build.
- Security
CVE-2026-90717: Dell Data Domain Management Center Authentication Bypass by Spoofing (CVSS 9.1)
A spoofing-based authentication bypass in Dell PowerProtect Data Domain Management Center is rated CVSS 9.1. Patch to the fixed DD OS builds in DSA-2026-416.
- Security
CVE-2026-54472: Hard-Coded Credentials in Dell CSM Docs Component Expose Sensitive Data
A hard-coded credential in Dell Container Storage Modules' csm-docs component lets unauthenticated attackers read sensitive data.
- Security
CVE-2026-61421: Hard-Coded JWT Signing Key in Dell CSM Authorization Enables Admin Token Forgery
A hard-coded JWT signing key in Dell CSM Authorization lets unauthenticated attackers forge admin tokens and seize control.
- Security
CVE-2026-63688: Missing Authentication in Dell CSM Authorization gRPC Server Exposes Storage Array Credentials
An unauthenticated gRPC server in Dell CSM Authorization lets attackers retrieve admin credentials for every registered storage array.
- Security
CVE-2026-63692: Dell CSM Authorization Proxy Missing Authentication Allows Cross-Tenant Admin Takeover
A missing authentication flaw in Dell CSM's authorization proxy lets unauthenticated attackers gain admin privileges across tenants.
- Security
CVE-2026-67269: Dell CSM Operator Flaw Lets Low-Privileged Users Escalate to Cluster Node Root
A Dell Container Storage Modules Operator flaw lets low-privileged Kubernetes users escalate to root via a crafted Custom Resource.
- News
Dell Patches Critical Root-Privilege Flaw in System Update Tool
Dell fixed a critical CVSS 9.6 path traversal bug (CVE-2026-86360) in its System Update CLI that lets attackers run code as root on PowerEdge servers.
- News
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
Dell patched six critical CSM flaws, including two CVSS 10.0 bugs, letting attackers steal storage admin credentials and gain root on Kubernetes nodes.
- Security
CVE-2026-66269: Dell OpenManage Server Administrator Unsafe Reflection Flaw
Dell patches an unauthenticated unsafe-reflection flaw in OpenManage Server Administrator that lets remote attackers bypass protection mechanisms.
- Security
CVE-2026-73600: Dell PowerProtect Data Manager Stack Buffer Overflow
A stack buffer overflow in Dell PowerProtect Data Manager's file-level restore agent lets a high-privileged attacker trigger information disclosure.
- Security
CVE-2026-63700: Dell Wyse Management Suite Privilege Escalation
Dell patches a high-severity privilege escalation flaw in Wyse Management Suite allowing local attackers to achieve full system compromise.
- Security
CVE-2026-53481: Dell PowerProtect Data Domain Path Traversal — CVSS 9.8
A critical path traversal vulnerability in Dell PowerProtect Data Domain backup appliances allows authenticated low-privilege users to read and write...
- Security
CVE-2026-53483: Dell PowerProtect Data Domain Authentication Bypass — CVSS 9.8
A critical authentication bypass in Dell PowerProtect Data Domain allows unauthenticated remote attackers to gain access to the backup platform. Combined...
- Security
CVE-2026-49814: Dell PowerProtect Data Domain OS Command Injection
A high-severity OS command injection vulnerability in Dell PowerProtect Data Domain allows authenticated remote attackers to execute arbitrary commands...
- Security
CVE-2026-46735: Dell DDPM Mac OS Command Injection Allows Local Privilege Escalation
A high-severity OS command injection flaw in Dell Display and Peripheral Manager for macOS (versions prior to 2.3) allows low-privileged local attackers...
- Security
Dell ECS and ObjectScale: Hard-Coded Credentials
A critical CVSS 9.8 hard-coded credentials vulnerability in Dell ECS and ObjectScale allows unauthenticated local attackers to gain full filesystem access...
- Security
CVE-2026-35155: Dell iDRAC10 Race Condition Enables
Dell iDRAC10 versions 1.20.70.50 and 1.30.05.10 contain a race condition vulnerability allowing authenticated low-privileged attackers to gain elevated...
- Security
CVE-2025-36568: Dell PowerProtect Data Domain BoostFS
A high-severity insufficiently protected credentials vulnerability in Dell PowerProtect Data Domain BoostFS allows low-privileged local attackers to...
- Security
Dell RecoverPoint Zero-Day Exploited by Chinese APT Since
A maximum-severity CVSS 10.0 hardcoded credentials vulnerability in Dell RecoverPoint for VMs has been under active exploitation by China-nexus threat...