What is the CVSS score of CVE-2026-46464?

CVE-2026-46464 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Is there a patch available for CVE-2026-46464?

Yes, a patch is available for CVE-2026-46464. Update the affected software to the latest version immediately.

PowerProtect Data Domain CVE-2026-46464

EUVD-2026-41546 MEDIUM

Improper Link Resolution Before File Access (CWE-59)

2026-07-03 dell

GHSA-pv3f-94f6-vhr2

Dell Information Disclosure Powerprotect Data Domain

4.9

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Vendor vector accepted as accurate: high privilege gates remote symlink abuse, with confidentiality-only impact and no integrity or availability effect.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 03, 2026 - 15:01 EUVD

Analysis Generated

Jul 03, 2026 - 14:20 vuln.today

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper link resolution before file access ('Link following') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.

AnalysisAI

Symlink-following vulnerability in Dell PowerProtect Data Domain allows a high-privileged remote attacker to traverse outside intended file paths and read arbitrary files, resulting in information disclosure. Multiple version branches are affected, including the current mainstream 8.7 release, LTS2026 builds through 8.6.1.10, LTS2025 builds through 8.3.1.30, and LTS2024 builds through 7.13.1.70. Dell published advisory DSA-2026-278 addressing this issue; no public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

CWE-59 (Improper Link Resolution Before File Access, commonly called 'link following') occurs when software dereferences a symbolic link during a file operation without validating that the resolved path remains within an intended directory boundary. In Dell PowerProtect Data Domain - a deduplication storage appliance platform identified by CPE cpe:2.3:a:dell:powerprotect_data_domain - a network-accessible component allows a high-privileged attacker to place or influence a symlink in a writable location. When the vulnerable component later performs a file-access operation following that link, it reads data outside the sanctioned path. This is a path-traversal variant at the OS filesystem layer rather than at the HTTP or application input layer, meaning standard input sanitization controls may not intercept it.

RemediationAI

Apply the patches specified in Dell security advisory DSA-2026-278, available at https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities. Consult the advisory directly for the exact remediated build number applicable to your release branch (mainstream, LTS2026, LTS2025, or LTS2024), as specific fixed versions were not independently confirmed in the available intelligence data. As a compensating control pending patch deployment, audit and minimize the number of accounts holding high-privileged access to Data Domain systems, since exploitation strictly requires PR:H credentials; reducing the administrative account surface directly reduces the attacker population that could trigger this flaw. Additionally, review Data Domain audit logs for unexpected file access patterns by privileged accounts. Note that access restriction mitigates risk but does not address the underlying symlink-resolution defect.