DSA-2026-368: Security Update for Dell PowerProtect Data Manager Multiple Vulnerabilities
概要: Dell PowerProtect Data Manager remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.
この記事は次に適用されます：
この記事は次には適用されません：
この記事は、特定の製品に関連付けられていません。
すべての製品パージョンがこの記事に記載されているわけではありません。
影響
High
詳細
|
Proprietary Code CVEs |
Description |
CVSS Base Score |
CVSS Vector String |
|
CVE-2026-73600 |
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure. | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
|
CVE-2026-68860 |
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to Launch of phishing attacks. |
6.8 |
|
|
CVE-2026-74769 |
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass. |
6.5 |
|
|
CVE-2026-74768 |
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure. |
4.1 |
|
Proprietary Code CVEs |
Description |
CVSS Base Score |
CVSS Vector String |
|
CVE-2026-73600 |
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure. | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
|
CVE-2026-68860 |
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to Launch of phishing attacks. |
6.8 |
|
|
CVE-2026-74769 |
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass. |
6.5 |
|
|
CVE-2026-74768 |
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure. |
4.1 |
影響を受ける製品と修復
|
CVEs Addressed |
Product |
Software/Firmware |
Affected Versions |
Remediated Versions |
Link |
|
CVE-2026-68860, CVE-2026-74769, CVE-2026-74768, CVE-2026-73600 |
Dell PowerProtect Data Manager |
Software |
Version 20.2.0.0 and prior |
20.3.0.0 |
|
CVEs Addressed |
Product |
Software/Firmware |
Affected Versions |
Remediated Versions |
Link |
|
CVE-2026-68860, CVE-2026-74769, CVE-2026-74768, CVE-2026-73600 |
Dell PowerProtect Data Manager |
Software |
Version 20.2.0.0 and prior |
20.3.0.0 |
変更履歴
|
Revision |
Date |
Description |
|
1.0 |
2026-08-24 |
Initial Release |
|
2.0 |
2026-08-26 |
Updated Affected Versions in the Affected Product and Remediation table |
確認
- Dell would like to thank Huynh Dinh Vu (WinD39) and Huynh Dinh Van for reporting this issue: CVE-2026-74769.
- Dell would like to thank saltedfish for reporting this issue: CVE-2026-74768.
関連情報
法的免責事項
対象製品
PowerProtect Data Manager Appliance, PowerProtect Data Manager, PowerProtect Data Manager Essentials, PowerProtect Data Manager Software文書のプロパティ
文書番号: 000501452
文書の種類: Dell Security Advisory
最終更新: 26 8月 2026
質問に対する他のDellユーザーからの回答を見つける
サポート サービス
お使いのデバイスがサポート サービスの対象かどうかを確認してください。