Dell PowerProtect One CVE-2026-74771

Exploitation requires a valid low-privileged account on the Dell PowerProtect One instance, as indicated by PR:L in the CVSS vector - unauthenticated access is not sufficient. The attacker must have remote network connectivity to the application. No elevated privileges, user interaction, or non-default configuration is required beyond the possession of any authenticated session. The scope is limited to data integrity (tampering); confidentiality and availability are not impacted. The primary limiting factor is the need for at least one valid credential, making insider threats or phishing/credential compromise a prerequisite attack vector.

The CVSS 3.1 base score of 6.5 (Medium) reflects a network-exploitable flaw requiring only low privileges with no user interaction and low attack complexity, but no confidentiality or availability impact - only integrity (I:H). This is consistent with an IDOR-class vulnerability where an attacker can modify data they should not have access to. No EPSS score was provided in the input data, so exploitation probability cannot be quantitatively assessed. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept has been identified, indicating no confirmed or widespread exploitation at time of analysis. The realistic priority for organizations running Dell PowerProtect One is moderate: the low privilege requirement means an attacker must first obtain a valid (even minimal) account, which limits opportunistic exploitation. However, in environments where many users have access to the platform, insider threat or credential-compromised scenarios elevate risk meaningfully given the I:H impact on protected backup data.

An attacker who holds a valid low-privileged account on a Dell PowerProtect One deployment sends crafted API or web requests in which they substitute another user's or object's key for their own - for example, replacing their own backup job or policy identifier with a known or enumerated one belonging to a higher-privileged account. Because the server fails to validate that the authenticated user owns or is authorized to modify the referenced object, the attacker successfully tampers with backup configurations, policies, or data records they should not be able to modify. No public proof-of-concept has been identified, but IDOR-class vulnerabilities of this type are frequently exploited manually without tooling given their low technical barrier.