What is the CVSS score of CVE-2026-46465?

CVE-2026-46465 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-46465?

Yes, a patch is available for CVE-2026-46465. Update the affected software to the latest version immediately.

PowerProtect Data Domain CVE-2026-46465

EUVD-2026-41545 MEDIUM

Use of Externally-Controlled Format String (CWE-134)

2026-07-03 dell

GHSA-7453-m98r-24j9

Denial Of Service Information Disclosure Dell Powerprotect Data Domain

5.5

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

vuln.today AI

5.5 MEDIUM

High privilege required for network exploitation; partial memory read warrants C:L, service crash warrants A:H, no integrity impact applies.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jul 03, 2026 - 15:01 EUVD

Analysis Generated

Jul 03, 2026 - 14:21 vuln.today

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of externally-controlled format string vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and denial of service.

AnalysisAI

Format string exploitation in Dell PowerProtect Data Domain enables remote high-privileged attackers to disclose memory contents and crash the service across multiple concurrent release trains. Affected versions span the mainline (7.7.1.0-8.7), LTS2026 (8.6.1.0-8.6.1.10), LTS2025 (8.3.1.0-8.3.1.30), and LTS2024 (7.13.1.0-7.13.1.70) branches, creating broad organizational exposure for enterprises running any supported Data Domain release. No public exploit or confirmed active exploitation has been identified at time of analysis; the mandatory high-privilege prerequisite substantially constrains the realistic attacker pool.

Technical ContextAI

CWE-134 (Use of Externally-Controlled Format String) describes a class of vulnerability where attacker-supplied data is passed unsanitized as the format argument to functions such as printf(), sprintf(), or syslog(). By injecting format specifiers (e.g., %x, %s, %n), an attacker can read arbitrary stack and heap memory - leaking sensitive runtime data - or corrupt memory and trigger a crash. Dell PowerProtect Data Domain is an enterprise-grade backup and deduplication platform deployed as both physical appliances and virtual editions. The CPE string cpe:2.3:a:dell:powerprotect_data_domain:*:*:*:*:*:*:*:* covers the software product across all editions. The management interfaces of Data Domain appliances (REST API, CLI, or administrative UI) are the likely attack surface given the network-accessible (AV:N) vector, as these are the paths through which a high-privileged session would supply crafted input reaching the vulnerable format string code path.

RemediationAI

Apply the vendor-released patches documented in Dell Security Advisory DSA-2026-278 at https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities; exact fixed version numbers are specified in that advisory and were not independently confirmed from the input data provided. As compensating controls while patches are staged, restrict access to the Data Domain management interfaces (REST API, administrative UI, CLI) to trusted management networks using firewall ACLs or jump-host architectures - this reduces the exposure surface for any remotely reachable high-privilege session. Enforce strict account governance by auditing all accounts holding high-privilege roles on Data Domain systems and removing or disabling any unnecessary administrative accounts; since PR:H is the hard prerequisite, reducing the number of valid high-privilege credentials directly limits the exploitable attack pool. Note that network segmentation reduces exposure but does not eliminate the vulnerability for internally-positioned or VPN-connected administrative users.