CVE-2026-28263 Cross-site scripting in PowerProtect Data Domain

Medium 5.9 Published 17 Apr 2026 Updated 18 Apr 2026

A high-privileged remote attacker can inject scripts into Dell PowerProtect Data Domain, potentially executing code or bypassing security controls.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2026-28263?

CVE-2026-28263 is a medium-severity cross-site scripting vulnerability in Dell Data Domain Operating System, published on 17 Apr 2026. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a cross-site Scripting vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.

Weakness: CWE-79

Which versions are affected by CVE-2026-28263?

It affects 2 products.

Products include Dell Data Domain Operating System, Dell Powerprotect Data Domain.

How do I fix CVE-2026-28263?

No fix has been published for CVE-2026-28263 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2026-28263 being exploited?

There is no known exploitation of CVE-2026-28263 in the wild and no public exploit code.

All Dell Data Domain Operating System vulnerabilities

Sources

Also known as GHSA-6w3g-2v88-h993.