Dell PowerProtect One CVE-2026-74770

Exploitation requires a valid low-privilege credential on the Dell PowerProtect One system, consistent with the CVSS PR:L metric - unauthenticated remote exploitation is not indicated by available data. Network-level access to the affected management interface is required (AV:N). Attack complexity is low (AC:L), meaning no race condition, special timing, or advanced preparation is needed beyond authentication. The specific vulnerable endpoint or feature within PowerProtect One is not identified in the available intelligence; consult Dell advisory DSA-2026-369 for that detail. Exploitation is constrained by the authentication requirement: attackers must possess or obtain a valid account, limiting opportunistic mass scanning but not precluding insider threat or credential-theft scenarios.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) presents a realistic and prioritizable threat: the attack is network-reachable, requires no elevated privileges beyond a basic authenticated session, and yields full host-level code execution. The low-privilege requirement (PR:L) is a meaningful threshold - any authenticated user, not just administrators, is a potential attacker, widening the threat surface in multi-tenant or large-team deployments. No EPSS score was provided in the input data, and the CVE does not appear in CISA KEV, suggesting no confirmed mass exploitation at this time; however, absence from KEV should not be treated as absence of risk given the straightforward exploitation conditions. Data protection platforms are high-value targets because they hold backup copies of sensitive organizational data, so even a mid-sized enterprise IT team running this platform should treat this as urgent remediation rather than a deferred patch. No POC has been publicly identified, which modestly reduces near-term risk but does not offset the severity of the underlying primitive.

An attacker with a low-privilege account on Dell PowerProtect One submits a crafted request to a network-accessible management endpoint, embedding OS metacharacters (e.g., a semicolon or pipe followed by an arbitrary command) in a parameter that is subsequently passed unsanitized to a shell invocation. The injected command executes with the privileges of the service process, granting the attacker arbitrary code execution on the appliance and potential access to backup data stores or lateral movement within the protected environment. No public proof-of-concept has been identified at time of analysis.