Dell PowerProtect Data Domain CVE-2026-56086

Exploitation requires network reachability to a Dell PowerProtect Data Domain management interface AND a valid low-privileged authenticated session (CVSS PR:L) on an affected DD OS build (mainline 7.7.1.0-8.6, LTS2026 8.6.1.0-8.6.1.10, LTS2025 8.3.1.0-8.3.1.30, or LTS2024 7.13.1.0-7.13.1.70); no user interaction and no high privileges are needed. The primary limiting factor is that the attacker must already hold some authenticated account - this is not anonymous pre-auth access despite the vendor's 'Authentication Bypass' tag - so realistic risk is highest where many operators hold restricted accounts or where credentials can be phished/reused, and lowest where management interfaces are isolated and account issuance is tightly controlled.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) indicates network-reachable, low-complexity exploitation that requires an existing low-privileged account and no user interaction, with full high impact to confidentiality, integrity, and availability on the appliance itself (scope unchanged). The single-source vendor tags label this 'Authentication Bypass,' which is somewhat broader than the CWE-863 'Incorrect Authorization' classification - in practice this reads as a privilege/authorization boundary bypass for an already-authenticated user rather than pre-auth access; verify the exact pre-condition with Dell. No EPSS score, POC, or KEV status was provided in the input, so probabilistic exploitation likelihood is unknown; absence of these signals is not evidence of low risk. The realistic priority is elevated because Data Domain appliances hold backup data (a high-value ransomware and data-exfiltration target) and because PR:L is a low bar in environments where many operators hold limited accounts, but the requirement for a valid low-privileged credential limits fully anonymous mass exploitation.

An attacker who has obtained or been issued a low-privileged Data Domain account (for example a monitoring or operator role, or a reused/leaked credential) connects to the reachable management interface over the network. Leveraging the incorrect authorization check, they invoke administrative functionality or access backup data that their role should not permit, gaining unauthorized read/write control over the appliance. No public POC was provided, but the low attack complexity and lack of required user interaction make development of a working exploit straightforward for someone with a foothold account.