CVE-2026-28263

CVE-2026-28263 is a cross-site scripting vulnerability affecting Dell PowerProtect Data Domain across multiple release versions, including Feature Release 7.7.1.0 through 8.5, LTS2025 release 8.3.1.0 through 8.3.1.20, and LTS2024 release 7.13.1.0 through 7.13.1.50. The vulnerability allows high-privileged remote attackers to inject malicious scripts through user interaction, compromising system integrity and confidentiality. The vulnerability carries a CVSS score of 5.9 (Medium) with a network attack vector, low complexity, and high privilege requirement. While user interaction is necessary for exploitation, successful attacks could result in limited compromise of confidentiality, integrity, and availability across system boundaries. There is currently no evidence of active exploitation in the wild, with zero EPSS prevalence and no presence on the KEV catalog or Hot List. Community attention remains minimal, indicating this remains a low-priority threat relative to other vulnerabilities, though affected organizations should still prioritize patching across all vulnerable release versions.