Dell PowerProtect Data Domain CVE-2026-90728

Exploitation requires the attacker to ALREADY possess a high-privileged account (PR:H) AND local access (AV:L) to the Dell PowerProtect Data Domain appliance - it is not remotely reachable and not exploitable by an unauthenticated or low-privileged user. Affected builds are Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The combination of mandatory local access and pre-existing high privilege is the primary factor limiting real-world exploitation to insiders or already-compromised privileged accounts; no user interaction is required once those prerequisites are met. The specific configuration or feature that triggers the improper privilege management is not described in the available sources.

This is a moderate-severity local privilege escalation (CVSS 6.3) that signals should NOT be treated as an urgent, widely-exploitable threat. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N is internally consistent with the description: AV:L confirms local access is required, and PR:H confirms the attacker must ALREADY hold high privileges before exploitation - meaning this is a privilege-boundary bypass for an existing trusted/administrative user, not an entry-point vulnerability. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit or PoC reference was supplied, so there is no evidence of active or imminent exploitation. The vuln.today Decision label is 'this_month', which aligns with patch-on-normal-cycle rather than emergency. The high PR:H prerequisite is the dominant risk-reducing factor: an attacker needs significant pre-existing access, which limits realistic exploitation to insiders or scenarios where a high-privilege account is already compromised. No key signals are in conflict; the main gap is that EPSS and any exploitation telemetry are absent, so risk is assessed from CVSS and vendor data alone.

An attacker who already holds a high-privileged local account on a Dell PowerProtect Data Domain appliance leverages the improper privilege management flaw to cross a privilege boundary and gain elevated (e.g., root/system-level) control of the appliance. No public exploit or PoC reference was provided, and the specific trigger is not described in the available sources. Because exploitation requires pre-existing high privileges and local access, the realistic actor is a malicious insider or an adversary who has already compromised a privileged account.