PowerProtect Data Domain CVE-2026-86383

Exploitation requires the attacker to already hold high-privilege (administrative-level) credentials on the Dell PowerProtect Data Domain appliance and network reachability to it (PR:H, AV:N, UI:N). Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The description does not name a specific feature, configuration setting, or deployment mode that must be enabled, and it does not describe the exact traversal trigger. The principal limiting factor is the high-privilege authentication requirement: an unprivileged or unauthenticated user cannot exploit this, which substantially narrows the realistic threat to insiders or an attacker who has already compromised an admin account.

This is a moderate-severity, limited-impact issue that does not rise to emergency status. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.8) tells a consistent story: network-reachable and low-complexity, but gated behind PR:H - the attacker must already hold high (administrative) privileges on the appliance. Per the CVSS vector the attacker is therefore authenticated at a high privilege level. Impact is confined to confidentiality (C:H) with no integrity or availability effect, consistent with the path-traversal/information-disclosure classification (CWE-22). The scope change (S:C) indicates the traversal can reach data outside the component's intended security boundary, which is why confidentiality is rated High despite the privilege requirement. No EPSS score, KEV listing, or PoC is present in the supplied intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_month' (not act_now/emergency), aligning with a signal set that is high-privilege-gated and confidentiality-only. The main tension to flag: a path-traversal flaw requiring PR:H is somewhat unusual, because an already-highly-privileged operator can often read such data by design - verify with Dell whether 'high privileged' here means a scoped/least-privilege admin role rather than full root, as that materially changes the real-world value of the primitive.

An attacker who has already obtained high-privilege (administrative) remote access to a Dell PowerProtect Data Domain appliance supplies a crafted pathname to an affected interface, using directory-traversal sequences to escape the intended restricted directory and read files outside it. The result is disclosure of sensitive data residing on the appliance beyond the component's intended boundary. No public PoC or exploit code is identified in the available data.