PowerProtect Data Domain CVE-2026-103780

Per the Dell advisory and CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires only network access to an affected PowerProtect Data Domain appliance - no authentication, no user interaction, and no non-default configuration is stated as a prerequisite. Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; systems outside these ranges are not in scope. The primary limiting factor is network reachability of the vulnerable service: appliances on isolated/management-only backup networks are far less exposed than those reachable from broader or untrusted networks. The specific port/service that must be reachable is not identified in the available sources.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, with high impact to confidentiality, integrity and availability (9.8 Critical), and the Dell advisory describes command execution - the most severe outcome. The vuln.today Decision label is act_now, reinforcing urgency. However, several corroborating signals are absent: no EPSS exploitation-probability score was provided, the CVE is not listed in CISA KEV, and no POC or exploit reference appears in the input, so there is no public exploit identified at time of analysis. The signals therefore align on severity but do not yet evidence active or imminent mass exploitation - the act_now label and 9.8 score reflect the potential (unauthenticated remote code/command execution on a backup appliance), while the lack of KEV/EPSS/POC means exploitation is currently theoretical rather than observed. Because Data Domain appliances store an organization's backups, successful exploitation undermines the recovery-of-last-resort, which materially raises real-world consequence even absent confirmed exploitation.

A remote attacker with network reachability to an affected Dell PowerProtect Data Domain appliance sends crafted input to the vulnerable network-facing service, overflowing a stack buffer (CWE-121) and leveraging the overflow to execute commands on the appliance without authenticating. The exact triggering service and request are not described in the available sources. No public exploit or POC was identified in the provided data.