PowerProtect Data Manager CVE-2026-44276

Exploitation requires two concurrent conditions: (1) local access to the system running Dell PowerProtect Data Manager, and (2) high-privilege (administrator-level) credentials on that PPDM instance. Both are confirmed by the CVSS vector (AV:L/PR:H). The vulnerable component is the REST API - exploitation occurs through API queries that, even when issued by a legitimate admin account, return sensitive data outside the intended disclosure boundary. No special non-default configuration, specific feature enablement, or user interaction is required beyond possessing admin credentials with local access. Limiting factors: purely remote unauthenticated exploitation is not possible given AV:L; the attack is also gated behind PR:H, meaning only those who have already attained administrative-level privilege - whether legitimately or through prior compromise - can trigger the exposure. The flaw does not enable privilege escalation to reach admin tier; that access must already exist.

The vendor-assigned CVSS 3.1 score of 6.0 (Medium) is derived from AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. The local attack vector (AV:L) and high-privilege requirement (PR:H) are the primary risk-limiting factors: exploitation is restricted to users who already hold administrative-level access on the PPDM host, effectively ruling out remote or unauthenticated attack paths. Attack complexity is low (AC:L) once that access is established, requiring no special race conditions or configuration chaining. The Scope:Changed (S:C) with C:H elevates the score above what a purely local info-leak would warrant, signaling that the downstream impact - credentials or secrets for systems managed by PPDM - may enable lateral movement to connected backup targets or protected workloads. No EPSS score was provided in the source data, so exploitation probability is unquantified. The vulnerability is not listed in CISA KEV, and no POC has been identified, making this a credible insider-threat or post-compromise escalation vector rather than a frontline attack surface. Real-world priority is moderate: high for organizations with strict need-to-know controls on backup infrastructure secrets, lower where admins are already fully trusted.

A local administrator on a Dell PowerProtect Data Manager instance running a version prior to 20.2.0.0 issues REST API requests using their admin credentials and receives sensitive information - such as backup target storage credentials, service account tokens, or configuration secrets for managed workloads - that are not intended to be visible even at the admin privilege tier. The attacker uses these harvested credentials to authenticate directly to connected storage systems or protected workloads, achieving lateral movement beyond the PPDM host. No public exploit code exists at time of analysis; exploitation requires pre-existing local administrative access.