Dell PowerProtect Data Domain CVE-2026-90730

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and description, exploitation requires only remote network access to an affected Dell PowerProtect Data Domain appliance with no authentication and no user interaction; no non-default feature or configuration is named as a prerequisite in the available sources. The practical limits are: impact is confined to denial of service (and partial integrity, C:N - no data disclosure), the affected product is a data-center backup appliance whose management interfaces are often network-segmented, and exposure depends on the appliance's reachable interfaces, which is not detailed in the sources. Affected releases are Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the exact trigger (component/protocol) is not described in the available sources.

Signals are consistent and point to a moderate, not urgent, priority. The CVSS 3.1 base score is 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, meaning remote, low-complexity, unauthenticated reach but impact bounded to partial integrity and partial availability with no confidentiality loss - the description frames the outcome as denial of service. The SSVC decision framework reinforces this: Exploitation 'none' (no known in-the-wild or public exploitation), Technical Impact 'partial', but Automatable 'yes', indicating that if an exploit emerges it could be scripted broadly. There is no CISA KEV listing and no PoC or exploit reference in the supplied data, so this is not confirmed exploited. EPSS is not provided, so exploitation-probability modeling is unavailable and cannot be weighed. The vuln.today Decision label is 'this_month', aligning with a patch-promptly-but-not-emergency posture. One cross-source tension worth noting: the input Tags include 'Authentication Bypass', yet the CVSS and description characterize the issue as Improper Access Control (CWE-284) leading to denial of service with only I:L/A:L and C:N - a full authentication bypass would typically carry confidentiality impact, so treat the 'Authentication Bypass' tag as unverified against the described DoS mechanism. Overall this is a real but moderate maintenance-priority item for Dell PowerProtect Data Domain operators, not a drop-everything emergency.

A remote attacker with network reachability to a PowerProtect Data Domain appliance's management or service interface sends crafted requests that abuse an improper access-control check, with no authentication or user interaction required (AV:N/AC:L/PR:N/UI:N), to disrupt availability. The SSVC 'Automatable: yes' rating means such an attack could be scripted against many exposed appliances once a technique is known. No public exploit identified at time of analysis, so this scenario is inferred from the CVSS vector and description rather than demonstrated code.