PowerProtect Data Manager CVE-2026-68860

The attack requires (1) the attacker be able to reach the PowerProtect Data Manager web interface over the network (AV:N), (2) high attack complexity - likely meaning the attacker must precisely craft a URL exploiting the layout assumption, (3) no authentication against PPDM itself (PR:N), and (4) a legitimate PPDM user must click the crafted link (UI:R). The victim must have a trust relationship with the PPDM domain (e.g., be an administrator or operator who regularly accesses the interface) for the phishing to be effective. Exploitation is limited by the AC:H constraint, meaning casual or automated scanning is unlikely to produce working exploits. Access to the PPDM management network is the primary environmental barrier - deployments where the management interface is internet-exposed face meaningfully higher risk than those restricted to corporate networks.

The CVSS base score of 6.8 (Medium) aligns reasonably with real-world risk for this class of vulnerability: the AC:H and UI:R constraints substantially reduce exploitability compared to a simple open redirect, and the 'launch of phishing attacks' impact is indirect rather than direct system compromise. EPSS data is not provided in the input, and no KEV listing or public exploit is known, suggesting this is not currently being actively targeted. Nevertheless, even a mid-sized municipal IT team in zabrze operating an on-premises PPDM deployment should treat this as worth patching promptly, because the product's trusted corporate domain being weaponized for phishing can undermine user trust and bypass email/URL reputation controls that would otherwise flag attacker domains. The mismatch between CWE-188 (typically a memory-layout assumption flaw) and the described phishing impact introduces some ambiguity about the precise root cause - the exact mechanism should be confirmed against the Dell advisory before concluding the issue is purely a redirect flaw with no additional memory-safety dimensions.

An attacker crafts a URL that routes through the PowerProtect Data Manager's web interface, exploiting the layout-parsing flaw to cause PPDM to redirect a victim to an attacker-controlled credential-harvesting page while displaying the trusted Dell/corporate PPDM hostname in the address bar. The attacker sends this link via email or chat to a legitimate PPDM user, who clicks it believing it is a valid PPDM management link. If the victim enters credentials on the attacker's page, those credentials are captured and can be used for further intrusion; no public proof-of-concept has been identified at this time.