Is CVE-2026-68860 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-68860 being exploited in the wild.

How severe is CVE-2026-68860?

Medium severity, with a CVSS score of 6.8, published 3 September 2026.

Which products and versions are affected?

Dell Powerprotect Data Manager 20.2.0.0 and below.

Is there a fix for CVE-2026-68860?

A patch was published on 2026-08-26: Patch available in version 20.3.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-68860 attacked?

It is attacked over the network.

Am I affected by CVE-2026-68860?

Check whether you run Dell Powerprotect Data Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-68860: Dell PowerProtect Data Manager information disclosure via memory layout reliance

CVE-2026-68860 · Severity: medium · CVSS 6.8 · Published 2026-09-03

Dell PowerProtect Data Manager is a backup and disaster recovery appliance used by enterprises to protect critical data. This vulnerability allows an unauthenticated attacker to exploit how the system handles data in memory, potentially exposing sensitive information that could be used to launch phishing attacks against users. An attacker needs user interaction to trigger the exploit, but requires no authentication to attempt the attack.

Technologies: Dell Powerprotect Data Manager. Vendors: Dell.

Quick answers

Is CVE-2026-68860 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-68860 being exploited in the wild.
How severe is CVE-2026-68860?: Medium severity, with a CVSS score of 6.8, published 3 September 2026.
Which products and versions are affected?: Dell Powerprotect Data Manager 20.2.0.0 and below.
Is there a fix for CVE-2026-68860?: A patch was published on 2026-08-26: Patch available in version 20.3.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68860 attacked?: It is attacked over the network.
Am I affected by CVE-2026-68860?: Check whether you run Dell Powerprotect Data Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a reliance on data/memory layout issue in PowerProtect Data Manager versions 20.2.0.0 and below. An unauthenticated remote attacker can exploit this via a network attack vector that requires user interaction and high complexity conditions. The vulnerability allows information disclosure and integrity compromise, enabling attackers to extract sensitive data for use in phishing campaigns. Dell has issued patches in version 20.3.0.0, and users should update immediately.

Affected products

Dell PowerProtect Data Manager 20.2.0.0 and below

Timeline

2026-09-03: disclosed
2026-08-24: advisory: Dell Security Advisory DSA-2026-368 initial release
2026-08-26: patched: Patch available in version 20.3.0.0

References

https://www.dell.com/support/kbdoc/en-us/000501452/dsa-2026-368-security-update-for-dell-powerprotect-data-manager-multiple-vulnerabilities

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.