CVE-2026-28263
Analyzed
Analyzed - Analysis Complete
Cross-Site Scripting in Dell PowerProtect Data Domain Enables Remote Attack
Vulnerability report for CVE-2026-28263, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-04-17
Last updated on: 2026-05-05
Assigner: Dell
Description
Description
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a cross-site Scripting vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dell | powerprotect_data_domain | From 8.3.1.0 (inc) to 8.3.1.20 (inc) |
| dell | powerprotect_data_domain | From 7.13.1.0 (inc) to 7.13.1.50 (inc) |
| dell | data_domain_operating_system | From 7.7.1.0 (inc) to 8.5.0.0 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
