What is the CVSS score of CVE-2026-44269?

CVE-2026-44269 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-44269?

Yes, a patch is available for CVE-2026-44269. Update the affected software to the latest version immediately.

PowerProtect Data Domain CVE-2026-44269

EUVD-2026-41532 MEDIUM

Improper Link Resolution Before File Access (CWE-59)

2026-07-03 dell

GHSA-72f3-wx74-78wc

Authentication Bypass Dell Powerprotect Data Domain

4.4

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.4 MEDIUM

Local-only attack vector and high-privilege requirement confirmed by description; confidentiality-only impact because link following enables unauthorized file reads with no write or availability consequence.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 03, 2026 - 14:01 EUVD

Analysis Generated

Jul 03, 2026 - 12:50 vuln.today

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper link resolution before file access ('link following') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.

AnalysisAI

Link-following exploitation in Dell PowerProtect Data Domain enables a high-privileged local attacker to read files outside their intended access scope by manipulating symbolic or hard links before file access operations resolve. Affected across multiple release trains - mainline 7.7.1.0 through 8.6, LTS2026 8.6.1.10 and below, LTS2025 8.3.1.30 and below, and LTS2024 7.13.1.70 and below. No public exploit code or active exploitation confirmed at time of analysis; risk is bounded by the requirement for pre-existing high-privilege local access.

Technical ContextAI

CWE-59 (Improper Link Resolution Before File Access, or 'link following') describes a class of vulnerability where software follows a symbolic or hard link to a path the attacker controls before the file operation is validated against an intended scope. In the Dell PowerProtect Data Domain context (CPE: cpe:2.3:a:dell:powerprotect_data_domain:*:*:*:*:*:*:*:*), an internal process or privileged utility performs file access without adequately canonicalizing the path, allowing a symlink placed by a high-privileged local account to redirect that access to an otherwise unauthorized file. This is a classic TOCTOU-adjacent pattern common in backup and storage management software, where privileged daemons traverse filesystem paths during backup catalog or management operations.

RemediationAI

Apply the Dell-released security updates documented in advisory DSA-2026-278 (https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities). Exact patched versions are not independently derivable from the provided data beyond the affected-version ranges; consult the advisory directly for target upgrade versions per branch (mainline, LTS2024, LTS2025, LTS2026). As a compensating control where immediate patching is not possible, restrict local shell or management-plane access to Data Domain appliances to only the minimum required administrative accounts, and audit which accounts hold high-privilege roles - this directly addresses the PR:H prerequisite. Note that restricting administrative access may impact legitimate backup orchestration workflows that rely on local privileged operations; validate against your backup automation before applying access controls.