CVE-2026-41122

{
  "id": "CVE-2026-41122",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-08T14:16:58.197",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain a stored cross-site scripting vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability. Exploitation may lead to information disclosure, session theft, or client-side request forgery."
    },
    {
      "lang": "es",
      "value": "Dell PowerProtect Data Domain, versiones 7.7.1.0 hasta 8.7, versión de lanzamiento LTS2026 8.6.1.0 hasta 8.6.1.10, versión de lanzamiento LTS2025 8.3.1.0 hasta 8.3.1.30, versiones de lanzamiento LTS2024 7.13.1.0 hasta 7.13.1.70 contienen una vulnerabilidad de cross-site scripting almacenado. Un atacante no autenticado con acceso remoto podría potencialmente explotar esta vulnerabilidad. La explotación podría conducir a la revelación de información, robo de sesión o falsificación de solicitudes del lado del cliente."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "PowerProtect Data Domain",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "8.8.0.0 or later",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "8.6.1.20 or later",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "8.3.1.40 or later",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "7.13.1.80 or later",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
          "baseScore": 7.1,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-08T14:25:12.097052Z",
          "id": "CVE-2026-41122",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.7.1.0",
              "versionEndExcluding": "7.13.1.80",
              "matchCriteriaId": "064F56BA-B974-4133-9DFA-B13D503766AC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "7.14.0.0",
              "versionEndExcluding": "8.3.1.40",
              "matchCriteriaId": "EB4BB568-B169-4202-94E0-8D808419241B"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.4.0.0",
              "versionEndExcluding": "8.6.1.20",
              "matchCriteriaId": "BA61361F-FED8-4936-A9F6-FFA35BE413F8"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.7.0.0",
              "versionEndExcluding": "8.8.0.0",
              "matchCriteriaId": "4BA45B0F-6A67-476D-9101-0DDC91B77D51"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}