EUVD-2026-41540
GHSA-vgwp-j4mh-9wxr
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Local-only vector and high privileges required reflect an admin-tier authorization bypass on a managed appliance; limited and equal CIA impact matches unauthorized command execution within a bounded, non-scoped system.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an incorrect authorization vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized command execution.
AnalysisAI
Incorrect authorization in Dell PowerProtect Data Domain permits a high-privileged local attacker to execute commands outside their authorized scope across a broad span of affected versions covering the main release line and all three active LTS branches. The root cause (CWE-863) indicates the appliance's Data Domain OS fails to enforce authorization boundaries correctly for certain operations accessible to already-elevated users, enabling privilege escalation within an authenticated administrative session. No public exploit code or active exploitation is confirmed at time of analysis; the CVSS 4.2 Medium score accurately reflects the significant access prerequisites - local presence plus high-level credentials - required to trigger the flaw.
Technical ContextAI
Dell PowerProtect Data Domain (formerly EMC Data Domain) is an enterprise backup and data deduplication appliance running a proprietary operating environment called Data Domain OS (DDOS). CWE-863 (Incorrect Authorization) describes a failure in the software's access-control enforcement logic: the system either omits an authorization check for a specific privileged operation or performs it incorrectly, allowing a user to invoke functionality their role should prohibit. In this case, an account already holding high privileges on the appliance can bypass intra-tier authorization controls to execute unauthorized commands. The affected version surface is wide, spanning main-line DDOS 7.7.1.0 through 8.7, LTS2024 releases 7.13.1.0 through 7.13.1.70, LTS2025 releases 8.3.1.0 through 8.3.1.30, and LTS2026 releases 8.6.1.0 through 8.6.1.10. The source metadata tags this as 'Authentication Bypass,' which is technically imprecise - the flaw is an authorization bypass within an already-authenticated high-privilege session, not a bypass of the authentication mechanism itself.
RemediationAI
Apply the patches detailed in Dell Security Advisory DSA-2026-278 (https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities). This advisory addresses multiple vulnerabilities simultaneously; the exact fixed version for CVE-2026-46730 per release track (main, LTS2024, LTS2025, LTS2026) is not independently confirmed from available data and must be obtained directly from the advisory. As a compensating control prior to patching, audit and reduce the set of accounts holding high-privileged roles on the appliance to only operationally necessary personnel - this shrinks the pool of potential threat actors without disrupting appliance function. Additionally, restrict interactive local and console access to the Data Domain system to authorized administrators only through network segmentation or jump-host controls; note this adds an operational layer but does not eliminate the underlying authorization flaw. No patch version should be assumed or inferred beyond what the Dell advisory specifies.
More in Data Domain Operating System
View allDell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficie
Improper authorization enforcement in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.6, plus LTS branches 8.6
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection v
Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. Ra
Denial of service in Dell PowerProtect Data Domain (DDOS versions 7.7.1.0 through 8.7, plus LTS2026 8.6.1.0-8.6.1.10, LT
Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of
Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerab
Stored cross-site scripting in Dell PowerProtect Data Domain (DD OS 7.7.1.0 through 8.7, plus the LTS2026 8.6.1.x, LTS20
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path t
OS command injection in Dell PowerProtect Data Domain enables a high-privileged local attacker to execute arbitrary oper
OS command injection in Dell PowerProtect Data Domain across four version release trains allows a high-privileged remote
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today