What is the CVSS score of CVE-2026-44268?

CVE-2026-44268 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-44268?

Yes, a patch is available for CVE-2026-44268. Update the affected software to the latest version immediately.

PowerProtect Data Domain CVE-2026-44268

EUVD-2026-41533 MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-07-03 dell

GHSA-xx59-c7wc-mgcj

Authentication Bypass Dell Powerprotect Data Domain

4.4

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.4 MEDIUM

Local attack vector and high privileges required align with a config-level permission flaw; confidentiality-only impact reflects read-access to a sensitive resource with no write or availability consequence.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 03, 2026 - 14:01 EUVD

Analysis Generated

Jul 03, 2026 - 12:50 vuln.today

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an incorrect permission Assignment for critical resource vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.

AnalysisAI

Incorrect permission assignment on a critical resource in Dell PowerProtect Data Domain exposes sensitive data to high-privileged local attackers across a broad range of supported release trains. The flaw (CWE-732) means a resource - likely a file, directory, or configuration object - carries overly permissive access controls, allowing a local attacker operating with elevated privileges to read data they are not authorized to access. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the breadth of affected versions (seven release trains spanning 2024-2026 LTS and mainline builds) increases aggregate exposure across enterprise backup environments.

Technical ContextAI

CWE-732 (Incorrect Permission Assignment for Critical Resource) indicates that one or more files, directories, sockets, or system resources in the Dell PowerProtect Data Domain software stack are assigned access permissions that are broader than the principle of least privilege requires. Dell PowerProtect Data Domain is a purpose-built backup and deduplication appliance widely deployed as enterprise data protection infrastructure; its OS-level and application-layer resource permissions govern access to potentially sensitive backup metadata, credentials, and configuration data. The CPE string cpe:2.3:a:dell:powerprotect_data_domain:*:*:*:*:*:*:*:* covers the application component across all versions. The CVSS vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N confirms the attack is local, requires no user interaction, but demands high-privilege access, and results exclusively in confidentiality loss - consistent with a read-permissive resource that leaks sensitive data without allowing modification or denial of service.

RemediationAI

Consult Dell security advisory DSA-2026-278 at https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities for patched build numbers across each release train; no specific fixed version number was included in the available intelligence data, so organizations should reference the advisory directly to identify the minimum fixed build for their deployed release. As a compensating control prior to patching, restrict local shell and administrative console access to the Data Domain appliance to only those accounts with an operational need, enforcing this at both the OS level and through Dell's role-based access control framework. Audit current local user accounts and remove or disable any high-privilege accounts that are not actively required. Monitor for unexpected access to sensitive configuration directories or credential stores via available audit log facilities. Note that restricting local access does not remediate the underlying permission flaw but significantly reduces the attacker precondition surface.