PowerProtect Data Domain CVE-2026-90726

Exploitation requires local access to the PowerProtect Data Domain appliance AND high (administrative) privileges on it, per AV:L/PR:H - it cannot be triggered remotely or by an unauthenticated user. No user interaction is needed (UI:N). The specific feature, protocol, or configuration that exposes the path traversal is not named in the available sources. The dominant limiting factors are the local-access and high-privilege prerequisites, which confine realistic exploitation to existing administrators or an attacker who has already compromised a privileged account; affected trains are Feature Release 7.7.1.0-8.8, LTS2024 7.13.1.0-7.13.1.80, LTS2025 8.3.1.0-8.3.1.40, and LTS2026 8.6.1.0-8.6.1.20.

This is a moderate-severity, operationally-gated issue rather than an urgent emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N, score 6.0) establishes that exploitation requires both local access to the appliance and high privileges, which sharply limits the attacker population to those who already hold administrative control of the PowerProtect Data Domain system. No EPSS score is provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV, and no proof-of-concept or exploit reference appears among the sources (only vendor and aggregator advisories) - therefore no public exploit is identified at time of analysis. The vendor-supplied priority (vuln.today Decision label 'this_month') aligns with a patch-this-cycle posture rather than act_now/emergency. One notable data conflict: the supplied CVSS vector asserts C:N/I:H/A:H, yet the description states the impact is only 'Denial of service' - the stated impact supports an availability hit but not a confidentiality or integrity compromise, so the input vector's I:H component is not corroborated by the narrative and should be verified with Dell. Overall this is a genuine but low-priority administrative/local DoS, not a widely-exploitable network threat.

An attacker who already holds high-privileged local access to a Dell PowerProtect Data Domain appliance supplies a crafted path to an affected feature, abusing a path traversal flaw (CWE-28) to disrupt a service and cause denial of service on the backup appliance. No public exploit code is identified, and the specific trigger is not described in the available sources. Because exploitation presupposes existing administrative access, the realistic scenario is an insider or an attacker who has already compromised a privileged account.