What is the CVSS score of CVE-2026-46466?

CVE-2026-46466 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-46466?

Yes, a patch is available for CVE-2026-46466. Update the affected software to the latest version immediately.

PowerProtect Data Domain CVE-2026-46466

EUVD-2026-41544 LOW

Use of Less Trusted Source (CWE-348)

2026-07-03 dell

GHSA-ch8c-p797-5ccg

Dell Information Disclosure Powerprotect Data Domain

2.7

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

2.7 LOW

High privileges required for remote exploitation; only limited integrity impact with no confidentiality or availability effect, consistent with vendor-provided vector.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Jul 03, 2026 - 15:01 EUVD

Analysis Generated

Jul 03, 2026 - 14:21 vuln.today

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of less trusted source vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information tampering.

AnalysisAI

Dell PowerProtect Data Domain's handling of a less-trusted data source allows a remote, high-privileged attacker to perform limited information tampering, classified under CWE-348. Affected are multiple release trains spanning versions 7.7.1.0 through 8.7, including LTS2024, LTS2025, and LTS2026 long-term support branches. With a CVSS base score of 2.7 (Low) and no confirmed active exploitation or public proof-of-concept, real-world impact is constrained by the high privilege requirement and the limited integrity-only scope of the vulnerability.

Technical ContextAI

Dell PowerProtect Data Domain (CPE: cpe:2.3:a:dell:powerprotect_data_domain:*:*:*:*:*:*:*:*) is an enterprise backup and deduplication appliance platform. CWE-348 (Use of Less Trusted Source) describes a class of flaw where software accepts or processes input from a less authoritative or less verified source when a more trusted source should take precedence - for example, prioritizing user-supplied metadata over system-authoritative data, or accepting configuration values from a lower-trust channel. In this context, a high-privileged remote actor can leverage this trust ordering flaw to inject or manipulate data, resulting in information tampering. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N confirms the flaw is exploitable over the network without user interaction, but strictly requires high-level credentials, and the integrity impact is limited with no confidentiality or availability consequence.

RemediationAI

The primary remediation is to apply the patched release identified in Dell Security Advisory DSA-2026-278, available at https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities. The exact fixed version numbers are not independently confirmed in the provided data beyond what Dell documents in that advisory - consult it directly for precise upgrade targets across each LTS track. As a compensating control prior to patching, organizations should audit and restrict high-privilege account access to the Data Domain management interface, apply role-based access controls to limit who holds administrative credentials, and restrict network access to the management plane via firewall rules or management VLANs. Restricting management access to known administrator workstations reduces the attack surface, though it does not eliminate the vulnerability. Given the low severity and high privilege prerequisite, the urgency for emergency patching is low; include this in the next scheduled maintenance window.