PowerProtect Data Domain CVE-2026-86398

Exploitation requires the attacker to already hold low-privileged credentials on the Dell PowerProtect Data Domain appliance (PR:L) and network reachability to it (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific product feature, endpoint, or request parameter that accepts the traversable pathname is not described in the available sources. The primary limiting factor is the authentication requirement - an attacker must first obtain valid low-privilege access, so this is not exploitable by a fully unauthenticated remote attacker. Affected deployments are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20.

This is a genuine priority, though short of an emergency. The input CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low privileges (PR:L) and no user interaction, which is a favorable profile for an authenticated attacker who already has any foothold on the appliance. The vuln.today decision label is 'this_week', consistent with a serious-but-not-actively-exploited issue. No EPSS score, no CISA KEV listing, and no PoC reference were supplied, so there is no public evidence of exploitation or weaponization - this is 'no public exploit identified at time of analysis'. A notable conflict exists between signals: the Dell-assigned CVSS claims full C:H/I:H/A:H impact, but the description only states the outcome as 'filesystem access for attacker', which most naturally describes confidentiality (file read) via path traversal and does not itself establish the integrity or availability impact the vector asserts - verify the write/overwrite capability with Dell. Overall this rates as a high-severity, authenticated path-traversal issue warranting prompt patching rather than a drop-everything emergency.

An attacker holding low-privileged credentials to a PowerProtect Data Domain appliance sends a crafted request over the network containing directory-traversal sequences (e.g. '../') to a vulnerable file-handling endpoint. Because the application fails to properly restrict the pathname, the request resolves outside the intended directory and grants the attacker access to files on the appliance filesystem. No public proof-of-concept or exploit code was provided in the available sources.