PowerProtect Data Domain CVE-2026-90727

Exploitation requires an attacker who already holds high privileges (PR:H - an administrative-level account) on the PowerProtect Data Domain system, with network access to it; it is therefore not usable by an unauthenticated or low-privileged remote attacker. The available advisories do not name the specific product feature, protocol, or configuration mode that processes the path-traversal input, so the exact triggering interface is not described in the available sources. The high-privilege precondition is the principal limiting factor and substantially narrows realistic exposure; impact is confined to limited integrity tampering (and limited availability per the input vector) with no confidentiality loss. Affected builds are FR 7.7.1.0 through 8.8, LTS2024 7.13.1.0-7.13.1.80, LTS2025 8.3.1.0-8.3.1.40, and LTS2026 8.6.1.0-8.6.1.20; updating to the fixed versions (7.13.1.90, 8.3.1.50, 8.6.1.30/8.9.0.0) remediates it.

This is a genuinely low-priority issue despite being network-reachable. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L, base 3.8) tells a consistent story: although the attack vector is network-based with low complexity and no user interaction, exploitation requires PR:H - high privileges already held on the appliance - and yields only limited integrity and availability impact with no confidentiality loss. The vuln.today Decision label is 'monitor', the weakest urgency tier, which aligns with the low base score. There is no CISA KEV listing and no EPSS score supplied, so there is no signal of active or probable exploitation; the references are vendor/aggregator advisories (Dell DSA-2026-416, VulDB, NVD) rather than confirmed working exploit code. The signals do not conflict: a low CVSS, a 'monitor' decision, no KEV, and a high-privilege precondition all point to a low real-world risk. The main caveat is that EPSS and any SSVC automatable/technical-impact sub-decisions are absent from the input, so prioritization rests on CVSS plus the vendor-assigned 'monitor' label rather than a quantitative exploitation probability. This is a high-CVSS-but-no - rather a low-CVSS and low-real-risk - maintenance-grade fix, not an emergency.

An attacker who already holds high-privilege (administrative-level) access to a PowerProtect Data Domain system, reachable over the network, submits a request containing relative path traversal sequences to reach files outside the intended directory, enabling limited tampering with data on the appliance. No public exploit or working PoC is identified in the provided sources, and the specific feature or interface that processes the traversal is not described in the available advisories.