PowerProtect Data Domain CVE-2026-56084

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication or user interaction is required: a remote attacker with network access to the appliance's exposed service can attempt exploitation against default configurations of Dell PowerProtect Data Domain. The description does not name the exact feature, endpoint, or configuration setting that triggers the SSRF, so the precise trigger is not described in the available sources. Limiting factors: the attacker must have network reachability to the affected appliance (typically a protected backup/storage management interface rather than internet-facing), and direct impact is confined to a low confidentiality effect (I:N/A:N) - the value to an attacker depends on which internal services the appliance can be coerced to reach. Affected branches are Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0-7.13.1.80, LTS2025 8.3.1.0-8.3.1.40, and LTS2026 8.6.1.0-8.6.1.20; fixes are 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0.

This is a moderate-risk vulnerability whose signals are consistent rather than conflicting. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, base 5.8) describes a network-reachable, low-complexity, unauthenticated flaw whose only direct impact is a low confidentiality effect across a changed scope - characteristic of SSRF (CWE-918), where the appliance can be coerced into issuing attacker-influenced requests to internal resources. There is no integrity or availability impact. No EPSS score, KEV listing, or PoC/exploit reference is present in the input, so there is no evidence of active exploitation or public exploit code; exploitation status is therefore 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month' (not act_now or emergency), which aligns with a medium-severity, no-known-exploitation posture: a patch exists and should be applied on a normal prioritized cycle rather than as an emergency. The main caveat is that the description does not state which feature, endpoint, or parsing path triggers the SSRF, so the real-world reachability of the internal targets an attacker could pivot to is unverified from the available sources. Net: a genuine but not top-tier priority - unauthenticated and remote, but limited to low confidentiality impact with no confirmed exploitation.

A remote, unauthenticated attacker sends a crafted request to an affected Dell PowerProtect Data Domain appliance, causing the appliance to issue a server-side request to an attacker-chosen destination, potentially reaching internal-only services or returning limited sensitive data. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with a changed scope, no authentication or user interaction is required and the impact can extend to systems beyond the appliance itself. No public proof-of-concept or exploit code is referenced in the available data.