PowerProtect Data Domain CVE-2026-90721

Exploitation requires high-privileged local access to the Dell PowerProtect Data Domain appliance (CVSS PR:H and AV:L); it is not remotely or anonymously reachable. The specific product feature, protocol, or configuration that exposes the path-traversal input is not described in the available sources, so no particular non-default setting can be confirmed as a prerequisite. The dominant limiting factors are the need for pre-existing high privileges and local access, which confine this to an already-trusted actor; the maximum confirmed impact is partial integrity loss and denial of service, with no confidentiality exposure. Only the listed version ranges across the Feature Release and LTS2024/2025/2026 branches are affected.

This is a low-severity, low-priority issue despite affecting an enterprise-critical product. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N, score 3.4) describes an attack that requires both local access (AV:L) and high privileges (PR:H) already on the Dell PowerProtect Data Domain appliance, with only partial integrity and availability impact (I:L/A:L) and no confidentiality impact (C:N). The vuln.today decision label is 'monitor', the lowest urgency tier. There is no CISA KEV listing and no EPSS score supplied; no public exploit is indicated. These signals are consistent and mutually reinforcing: an attacker who already holds high privileges with local access to a backup appliance causing a denial of service represents marginal additional risk, since such an attacker is already in a highly trusted position. No signals conflict. The only real-world escalation path would be chaining with a separate privilege-escalation or remote-access flaw, which is not described here. Note that the input provides no EPSS value and no SSVC automatable/technical-impact breakdown, so exploitation probability cannot be quantified from the data given.

An attacker who has already obtained high-privileged local access to a Dell PowerProtect Data Domain appliance supplies a crafted path that escapes the intended directory, triggering a denial-of-service condition that degrades the backup/recovery service. No public exploit is indicated, and the specific triggering interface is not described in the Dell advisory summary. The high-privilege and local-access prerequisites make this a post-compromise action rather than an initial-access vector.