PowerProtect Data Domain CVE-2026-92665

Exploitation requires only network reachability to an affected Dell PowerProtect Data Domain appliance; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity against affected versions. The specific service, protocol, port, or configuration that must be exposed for the resource-exhaustion condition is not described in the available sources (only the Dell advisory is referenced, not its detail). Limiting factors: impact is confined to availability (A:L) with no confidentiality or integrity effect, exploitation presupposes the attacker can reach the appliance's network interface (appliances are typically on segmented management/backup networks, reducing exposure), and only the listed release ranges are affected - updating to the fixed builds in DSA-2026-416 (versions not reproduced here) removes the issue.

This is a moderate, availability-only issue, not an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) indicates a network-reachable, low-complexity, unauthenticated flaw that affects only availability at a limited (A:L) level, with no confidentiality or integrity impact - consistent with the CWE-770 resource-exhaustion class and the 'Denial of service' outcome stated by Dell. The vuln.today decision label is 'this_month', signaling a planned-remediation rather than act_now/emergency priority. No EPSS score, KEV listing, or PoC/exploit reference is present in the supplied data, so there is no evidence of active exploitation or public exploit code. The signals are internally consistent: a medium-severity DoS reported by the vendor with no exploitation evidence. The main caveat is that the single Dell advisory (DSA-2026-416) is referenced but its detailed contents are not included here, so the precise resource being exhausted, the affected service/port, and whether the DoS is a crash or degradation are not described in the available sources - treat the mechanism as unverified and confirm scope with the Dell KB.

A remote attacker with network access to a PowerProtect Data Domain appliance's management or data-path service sends a volume of requests or specially-shaped traffic that the appliance fails to limit or throttle (CWE-770), exhausting a finite resource and degrading or interrupting service. No authentication or user interaction is required (AV:N/PR:N/UI:N) and complexity is low (AC:L), but impact is limited to availability (A:L) with no data compromise. No public exploit code or PoC reference is included in the supplied data.