Dell PowerProtect One CVE-2026-74774

The attacker must be positioned to intercept TLS communications between Dell PowerProtect One and a communicating peer - achieved through techniques such as ARP spoofing, rogue DHCP, compromised routing infrastructure, or DNS hijacking on the network segment hosting the appliance. Per the provided CVSS vector (PR:N), no prior authentication to the appliance is required. However, SSVC 'Automatable: no' indicates that fully automated opportunistic exploitation at internet scale is not feasible, implying the MitM positioning requirement substantially narrows the realistic attacker pool to those with network-level access to the target environment. Impact is limited strictly to confidentiality - no integrity modification or availability disruption is possible through this vector. Systems running version 20.3.0.0 or later are not affected.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) scores this at 7.5 and nominally categorizes it as remotely exploitable with no prerequisites and high confidentiality impact; however, the SSVC 'Automatable: no' classification is a meaningful divergence from the AC:L base metric, indicating that practical exploitation carries positioning requirements - likely network intercept capability - not fully reflected in the base score. EPSS at 0.14% (4th percentile) and SSVC exploitation status of 'none' both confirm that threat actors have not operationalized this flaw, and the absence from CISA KEV reinforces this. The impact is bounded strictly to confidentiality (I:N, A:N), ruling out service disruption or code execution scenarios. Taken together, these signals support prioritizing this patch in the normal vulnerability management cycle rather than as an emergency response, though environments where PowerProtect One handles sensitive backup streams warrant expedited action.

An attacker with network interception capability - such as a rogue device on the same LAN segment, a compromised network hop, or DNS/ARP spoofing access - presents a fraudulent TLS certificate to a PowerProtect One instance during a replication or agent communication session. Because the product does not properly validate the certificate, the TLS handshake completes against the attacker-controlled endpoint, allowing decryption of backup management traffic and potential extraction of credentials or configuration data. No public proof-of-concept exploit code has been identified at time of analysis.