PowerProtect Data Domain Management Center CVE-2026-86401

Exploitation requires the attacker to already hold a high-privileged (administrative) account on the PowerProtect Data Domain Management Center (per CVSS PR:H) with remote network reachability to the management interface. The specific feature, parameter, or query path that accepts the injected SQL is not described in the available sources. The dominant limiting factor is the high-privilege prerequisite: this is not exploitable by unauthenticated or low-privileged users, which sharply constrains real-world risk to insiders or already-compromised administrative sessions. Impact is confined to information exposure (read access); no data modification or service disruption is indicated.

This is a low-priority, high-barrier issue despite being a SQL injection flaw. The CVSS base score is only 2.7 (Low), driven by PR:H (requires an already high-privileged account) and a limited impact profile of C:L/I:N/A:N - confidentiality-only information exposure with no integrity or availability impact. The attack vector is network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but the high-privilege prerequisite is the dominant limiting factor: an attacker must already hold elevated access to the management center before this adds any value. There is no EPSS score, no CISA KEV listing, and no POC or exploit reference in the provided data, all of which align with the vendor/vuln.today 'monitor' decision label rather than an urgent one. The signals are internally consistent (low CVSS, no exploitation evidence, monitor priority), so this reads as a genuine low-urgency defect - a privilege-escalation-amplifier or insider/post-compromise data-exposure concern, not a widespread remote threat. It is reported by Dell itself, suggesting internal discovery rather than observed in-the-wild activity.

An attacker who has already obtained high-privileged (administrative) access to the PowerProtect Data Domain Management Center sends a crafted request containing malicious SQL that is improperly neutralized before reaching the database, causing the backend to return data the attacker should not be able to read. No public exploit code or POC reference is present in the provided data, and the specific injectable parameter or feature is not described in the available sources. The realistic value is as a post-compromise data-exposure technique rather than an initial-access vector, since elevated privileges are a prerequisite.