PowerProtect Data Domain CVE-2026-68866

Exploitation requires an authenticated session with high-privilege (administrative) access to the PowerProtect Data Domain appliance (CVSS PR:H) and remote network reachability to the management interface (AV:N). The trigger is a crafted certificate processed by the appliance's certificate handling, where relative path traversal (CWE-23) is possible; the exact certificate feature or endpoint is not detailed in the available sources. The principal limiting factor is the high-privilege authentication requirement, which restricts realistic exploitation to admins, insiders, or attackers who have already obtained administrative credentials; no user interaction is required. Affected: Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0-7.13.1.70, LTS2025 8.3.1.0-8.3.1.30, LTS2026 8.6.1.0-8.6.1.10.

This is a medium-severity issue (CVSS 6.5) whose real-world risk is substantially gated by its prerequisites. The vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N is network-reachable with low complexity, but PR:H means the attacker must already hold high-privilege (administrative) access to the Data Domain appliance, which sharply narrows the realistic threat to insiders or an adversary who has already compromised admin credentials. There is a notable internal inconsistency to flag: the description states the impact is solely 'Denial of service,' yet the supplied CVSS vector encodes C:N/I:H/A:H (high integrity AND availability impact) - the I:H component is not supported by the narrative text and should be verified with Dell. No EPSS score, no CISA KEV listing, and no public exploit were provided, so there is no signal of active or imminent exploitation. The vuln.today decision label is 'this_month,' consistent with a patch-on-normal-cadence item rather than an emergency. Net: a legitimate but non-urgent fix - a post-authentication availability bug on a high-value backup appliance, worth patching within the vendor's suggested window rather than as a drop-everything event.

An attacker who already holds high-privilege administrative credentials on a PowerProtect Data Domain appliance (an insider, or an adversary who has compromised an admin account) submits a crafted certificate whose path contains relative traversal sequences. The appliance processes the certificate without properly constraining the path, escaping the intended directory and disrupting the service to cause a denial of service. No public exploit code was identified at time of analysis.