# CVE-2026-73600: Dell PowerProtect Data Manager stack buffer overflow in file-level restore agent

Source: https://junglewise.ai/threats/cve-2026-73600-dell-powerprotect-data-manager-stack-buffer-overflow-in-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-73600 · Severity: high · CVSS 7.8 · Published 2026-09-03

Dell PowerProtect Data Manager is a data backup and recovery solution used by enterprises to protect critical business data. A stack buffer overflow vulnerability in the file-level restore agent could allow a privileged attacker to crash the application or execute arbitrary code, potentially compromising the confidentiality and integrity of the system and the data it manages.

Technologies: [Dell Powerprotect Data Manager](https://junglewise.ai/threats/technologies/powerprotect-data-manager). Vendors: [Dell](https://junglewise.ai/threats/vendors/dell).

## Quick answers

**Is CVE-2026-73600 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73600 being exploited in the wild.

**How severe is CVE-2026-73600?** High severity, with a CVSS score of 7.8, published 3 September 2026.

**Which products and versions are affected?** Dell Powerprotect Data Manager 20.2.0.0 and below.

**Is there a fix for CVE-2026-73600?** A patch was published on 2026-08-24: Patch version 20.3.0.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-73600 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-73600?** Check whether you run Dell Powerprotect Data Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

CVE-2026-73600 is a stack buffer overflow vulnerability in the file-level restore agent component of Dell PowerProtect Data Manager versions 20.2.0.0 and below. The vulnerability requires local or adjacent network access and a user with low-level privileges to exploit. An attacker with these credentials can trigger the buffer overflow condition, potentially leading to information disclosure, denial of service, or code execution. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates local attack surface with low complexity. Dell has released patched version 20.3.0.0 to address this and related vulnerabilities.

## Affected products

- Dell PowerProtect Data Manager 20.2.0.0 and below

## Timeline

- 2026-09-03: disclosed
- 2026-08-24: patched: Patch version 20.3.0.0 released

## References

- [https://www.dell.com/support/kbdoc/en-us/000501452/dsa-2026-368-security-update-for-dell-powerprotect-data-manager-multiple-vulnerabilities](https://www.dell.com/support/kbdoc/en-us/000501452/dsa-2026-368-security-update-for-dell-powerprotect-data-manager-multiple-vulnerabilities)

## Related threats

- [Dell PowerProtect Data Manager incorrect authorization in REST API](https://junglewise.ai/threats/cve-2026-74769-dell-powerprotect-data-manager-incorrect-authorization-in-rest)
- [Dell PowerProtect Data Manager SSRF in REST API](https://junglewise.ai/threats/cve-2026-74768-dell-powerprotect-data-manager-ssrf-in-rest-api)
- [Dell PowerProtect Data Manager information disclosure via memory layout reliance](https://junglewise.ai/threats/cve-2026-68860-dell-powerprotect-data-manager-information-disclosure-via-memory)
- [Dell PowerProtect Data Manager privilege escalation in IAM](https://junglewise.ai/threats/cve-2026-49499-dell-powerprotect-data-manager-privilege-escalation-in-iam)
- [Dell PowerProtect Data Manager privilege escalation in REST API](https://junglewise.ai/threats/cve-2026-46738-dell-powerprotect-data-manager-privilege-escalation-in-rest-api)