What is the CVSS score of CVE-2025-46641?

CVE-2025-46641 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2025-46641?

Yes, a patch is available for CVE-2025-46641. Update the affected software to the latest version immediately.

Dell CVE-2025-46641

EUVD-2025-209523 MEDIUM

Improper Authentication (CWE-287)

2026-04-17 dell

GHSA-536m-vwvg-ggr6

Authentication Bypass Dell

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 17, 2026 - 15:07 nvd

Patch available

Apr 17, 2026 - 12:01 EUVD

Analysis Generated

Apr 17, 2026 - 11:55 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 11:45 euvd

EUVD-2025-209523

Analysis Generated

Apr 17, 2026 - 11:45 vuln.today

CVE Published

Apr 17, 2026 - 11:19 nvd

MEDIUM 6.6

DescriptionCVE.org

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper authentication vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

AnalysisAI

Dell PowerProtect Data Domain versions 8.4 through 8.5 contain an improper authentication vulnerability allowing high-privileged remote attackers to bypass authentication and gain unauthorized access to the system. CVSS 6.6 (high complexity, high privileges required) reflects the need for elevated attacker credentials but significant confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

PowerProtect Data Domain is Dell's enterprise deduplication and backup storage platform. The vulnerability resides in the authentication mechanism (CWE-287: Improper Authentication) of DD OS Feature Release versions 8.4 and 8.5, which handle privilege escalation and access control. The improper implementation allows high-privileged users to circumvent normal authentication checks, suggesting either a logic flaw in session validation, privilege boundary enforcement, or role-based access control (RBAC) implementation. The CVSS vector AV:N/AC:H/PR:H indicates the flaw requires network access but is not trivial to exploit (high complexity) and demands pre-existing high-level credentials, limiting the attack surface to administrators or accounts with significant system privileges.

RemediationAI

Apply Dell's security patch released in DSA-2026-060 available at https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities. The exact patched version is not specified in provided references-consult the Dell advisory for version 8.6 or later confirmation. As an interim compensating control, restrict network access to Data Domain administrative interfaces (typically port 3009 for web console and port 111/2049 for NFS) to trusted management subnets only, enforcing ingress filtering at the network perimeter. Implement strong authentication controls for high-privilege accounts: enforce multi-factor authentication (MFA) for administrative logins if supported, disable default service accounts, and rotate administrative credentials immediately. Monitor administrative session logs for anomalous privilege escalation or lateral movement patterns. These controls reduce the window of opportunity for a high-privilege attacker but do not eliminate the underlying flaw.