CVE-2026-41122

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain a stored cross-site scripting vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability. Exploitation may lead to information disclosure, session theft, or client-side request forgery.

• CWE-79

• https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9Vendor Advisory

Published

Jul 8, 2026

Last Modified

Jul 8, 2026

Status

Analyzed

• CVE-2026-41115An improper authorization vulnerability has been identified …4.3
• CVE-2026-41116Dell Inventory Collector Client, versions prior to 13.8.0, c…6.3
• CVE-2026-41119Dell Live Optics Windows and Personal Edition collectors con…6.8
• CVE-2026-4112Improper neutralization of special elements used in an SQL c…7.2
• CVE-2026-41120Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, c…9.8
• CVE-2026-41121Dell Device Management Agent, versions prior to DDMA 26.05, …7.8
• CVE-2026-41123Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6,…4.3
• CVE-2026-41124Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6,…4.4
• CVE-2026-41125A vulnerability has been identified in blueplanet 100 NX3 M8…6
• CVE-2026-41126BigBlueButton is an open-source virtual classroom. Versions …4.3
• CVE-2026-41127BigBlueButton is an open-source virtual classroom. Versions …6.5
• CVE-2026-41128Craft CMS is a content management system (CMS). In versions …5.3