PowerProtect DDMC CVE-2026-103799

Requires the attacker to already hold valid low-privileged credentials on a network-reachable PowerProtect Data Domain Management Center instance (PR:L), from which the missing authorization check (CWE-862) allows invoking operations that should be restricted, affecting the managed Data Domain systems. Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. Limiting factors: exploitation needs an authenticated low-privileged account rather than fully anonymous access, which constrains it to attackers who can obtain or already possess DDMC credentials; no user interaction is required and no non-default configuration is noted in the available sources. The specific operation or endpoint that lacks the authorization check is not described in the available sources.

All signals point the same direction: this is a genuine priority, not a CVSS-inflation artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) describes a network-reachable flaw of low attack complexity requiring only low privileges and no user interaction, and the critical 9.6 is driven primarily by the scope change (S:C) - the vulnerability lives in the management center but its impact (I:H/A:H) lands on the managed systems it controls, which is consistent with a missing-authorization flaw (CWE-862). The vuln.today decision label is act_now, reinforcing urgency. However, several exploitation signals are absent from the input: no EPSS probability is provided, there is no CISA KEV listing, and there is no public PoC or exploit reference - so no public exploit identified at time of analysis. This means the priority rests on intrinsic severity (critical CVSS, scope change, data-protection/backup infrastructure as the target) and the vendor/aggregator urgency signal rather than on observed exploitation. The one point to verify: confidentiality is scored N (C:N) despite I:H/A:H, so the flaw is characterized as an integrity/availability (unauthorized operation) issue rather than data disclosure - defenders tracking exfiltration risk should note that distinction.

An attacker who holds a valid low-privileged account on an internet- or network-reachable PowerProtect Data Domain Management Center sends requests to operations that should be restricted to higher-privileged roles; because the authorization check is missing, those requests succeed and the attacker performs unauthorized operations against the managed Data Domain systems. No user interaction is required and attack complexity is low. No public exploit identified at time of analysis.