PowerProtect Data Domain CVE-2026-90725

Exploitation requires an attacker to already hold high privileges (administrative-level access, PR:H) on the Dell PowerProtect Data Domain appliance and to reach it over the network (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L) once those privileges are held. The specific feature, protocol, or interface that carries the overflowing input is not described in the available sources. The principal limiting factor is the high-privilege prerequisite, which restricts realistic exploitation to authenticated administrators or post-compromise scenarios rather than unauthenticated external attackers; impact is confined to denial of service (no data disclosure or modification). Affected: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20; fixed in 7.13.1.90, 8.9.0.0, 8.6.1.30, and 8.3.1.50.

This is a genuinely low-to-moderate priority issue despite being network-reachable. The CVSS 3.1 base score is 4.9 (Medium), and the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H tells a consistent story: an attacker needs network access AND high privileges (PR:H) to trigger the flaw, and the only impact is availability (A:H) - no confidentiality or integrity loss. Dell (the reporting source) rates it accordingly. The vuln.today decision label is 'this_month', not act_now or emergency, which aligns with the limited impact. It is NOT in CISA KEV (no confirmed active exploitation), and no EPSS score was supplied, so widespread automated exploitation cannot be inferred. There is no public exploit identified in the provided data. The dominant risk-limiting factor is PR:H: an attacker must already hold high (administrative-level) privileges on the appliance, which largely confines this to insider misuse or post-compromise denial of service rather than an external break-in. Missing signals to note explicitly: EPSS probability was not provided, and no PoC/exploit reference is marked as working exploit code, so real-world exploitation likelihood is unquantified from this data.

An attacker who already possesses high (administrative) privileges on a Dell PowerProtect Data Domain appliance and can reach it over the network sends crafted input that overflows a stack buffer, crashing the affected service or appliance and denying backup/restore availability. The specific component and triggering input are not described in the available sources. No public exploit code is identified at time of analysis.