PowerProtect Data Domain CVE-2026-90732

Exploitation requires an attacker to already hold HIGH privileges (PR:H, i.e. administrative-level access) on the Dell PowerProtect Data Domain appliance, reachable over the network (AV:N) with low complexity and no user interaction. The impact is limited strictly to denial of service (availability only; no confidentiality or integrity effect). The high-privilege prerequisite is the primary limiting factor - this is not remotely exploitable by an unauthenticated or low-privileged user. Affected releases are Feature Release 7.7.1.0 through LTS 2026, LTS2024 7.13.1.0-7.13.1.80, LTS2025 8.3.1.0-8.3.1.40, and LTS2026 8.6.1.0-8.6.1.20; fixed in 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0. The specific feature or protocol that triggers the overflow is not described in the available sources. Per the vendor advisory, applying the updated version is the remediation.

This is a genuinely low-to-moderate priority issue despite the buffer-overflow class. The CVSS 3.1 base score is 4.9 (Medium), and every signal points to constrained real-world risk: the vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H shows that although the flaw is reachable over the network with low attack complexity and no user interaction, it requires HIGH privileges (PR:H) and its only impact is availability (A:H) - there is no confidentiality or integrity loss. In plain terms, an attacker must already hold high-privileged (administrative) access to the appliance to crash it. No EPSS score was supplied, the CVE is NOT on the CISA KEV list, and no public exploit or PoC reference is present in the input, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' (not act_now/emergency), which is consistent with a vendor-reported, patched, DoS-only, high-privilege-gated issue. No signals conflict here; the main caveat is that the description does not explain how the overflow is triggered, so the exact exploitation path is unverified.

An attacker who already possesses high-privileged (administrative) credentials on a Dell PowerProtect Data Domain system sends crafted input over the network to a component vulnerable to a stack-based buffer overflow, corrupting the stack and crashing the service to cause a denial of service. Because impact is limited to availability (C:N/I:N) and requires existing high privileges, this is realistically an insider or post-compromise disruption scenario rather than an external breach vector. No public exploit code or PoC reference was provided in the available sources.