PowerProtect Data Domain CVE-2026-103779

Requires a low-privileged authenticated foothold (PR:L) with network access to a Dell PowerProtect Data Domain appliance; exploitation then abuses the improper authentication logic to achieve a protection-mechanism bypass. The available sources do not name the exact feature, protocol endpoint, or configuration setting involved, so the precise trigger is not described in the available data. Limiting factors confirmed from the evidence: the attacker must already possess low-level credentials/privileges (not unauthenticated), and the affected software is confined to the listed branches - Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20.

This is a credible this-week priority rather than an inflated high-CVSS score, though it stops short of emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:L, score 8.3) describes a network-reachable, low-complexity flaw that requires only low privileges and no user interaction, with high confidentiality and integrity impact and low availability impact on an unchanged scope. The decisive risk factor is the asset class: PowerProtect Data Domain is a purpose-built backup/recovery appliance, so an improper-authentication protection-mechanism bypass directly undermines the control that is supposed to protect backup data - the last line of defense against ransomware. Tempering that: exploitation is not unauthenticated (PR:L requires an already-low-privileged foothold), no EPSS score was supplied, the vulnerability is NOT in CISA KEV, and no public exploit or PoC reference was provided. The signals are therefore consistent rather than conflicting - moderate-to-high severity, vendor-reported, no evidence of active exploitation - supporting the 'this_week' decision label over 'act_now'. No EPSS value is available to gauge exploitation probability; this absence is a data gap, not a sign of low risk.

An attacker who already holds a low-privileged account or foothold with network access to a Data Domain appliance's management interface sends requests that abuse the improper authentication logic to bypass a protection mechanism, gaining access or actions beyond their authorization level. Because the flaw affects confidentiality and integrity highly, this could expose or tamper with protected backup data. No public exploit code or PoC reference was provided in the available data.