What is the CVSS score of CVE-2026-46463?

CVE-2026-46463 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-46463?

Yes, a patch is available for CVE-2026-46463. Update the affected software to the latest version immediately.

PowerProtect Data Domain CVE-2026-46463

EUVD-2026-41547 MEDIUM

Integer Overflow or Wraparound (CWE-190)

2026-07-03 dell

GHSA-xgmx-456f-v7hp

Denial Of Service Integer Overflow Dell Powerprotect Data Domain

6.5

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

vuln.today AI

5.9 MEDIUM

Description confirms only DoS impact; I:L dropped as unsubstantiated; AC:H and PR:N retained per unauthenticated remote vector with noted complexity.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

Patch available

Jul 03, 2026 - 15:01 EUVD

Analysis Generated

Jul 03, 2026 - 14:22 vuln.today

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an integer overflow or wraparound vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

AnalysisAI

Integer overflow in Dell PowerProtect Data Domain across multiple release trains (main, LTS2024, LTS2025, LTS2026) exposes backup and data protection infrastructure to remote denial of service by an unauthenticated attacker. The CVSS vector (AV:N/AC:H/PR:N) confirms network-accessible, unauthenticated exploitation, though high attack complexity constrains practical exploitation to adversaries who can satisfy specific preconditions. No public exploit has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.

Technical ContextAI

CWE-190 (Integer Overflow or Wraparound) describes a class of flaws where arithmetic operations on integer values exceed the bounds of the data type, causing wrap-around to an unexpected value - commonly leading to incorrect memory allocations, buffer overflows, or logic errors that destabilize the process. Dell PowerProtect Data Domain (CPE: cpe:2.3:a:dell:powerprotect_data_domain) is an enterprise-grade deduplication storage appliance used for backup, archival, and disaster recovery workflows. As a network-reachable appliance (AV:N), its data-path processing surfaces are exposed to specially crafted requests that may carry malformed size or length fields capable of triggering the integer wraparound. The application-layer CPE prefix confirms this is a software flaw in the Data Domain OS/application layer rather than a firmware or hardware defect.

RemediationAI

Patch available per vendor advisory - Dell has published DSA-2026-278 at https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities, which contains specific fixed build numbers for each affected release train (main, LTS2024, LTS2025, LTS2026). Organizations should consult that advisory directly for the exact target upgrade version applicable to their release stream, as no specific fixed version number was independently provided in the available intelligence data. As a compensating control for organizations that cannot immediately patch, restricting network access to Data Domain management and data-path interfaces via firewall ACLs or network segmentation reduces the attack surface, since the vulnerability requires remote network reachability (AV:N). Note that this control does not eliminate the vulnerability if trusted backup servers or management hosts are themselves compromised. Monitoring for anomalous connection volumes or malformed protocol traffic to Data Domain interfaces may provide early warning of exploitation attempts.