PowerProtect Data Domain CVE-2026-94346

Exploitation requires an attacker who already holds HIGH privileges (administrative-level access) on PowerProtect Data Domain Virtual Edition, reaching the appliance over the network (AV:N). Affected: Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.70, LTS2025 8.3.1.0 through 8.3.1.30, and LTS2026 8.6.1.0 through 8.6.1.10. The key limiting factor is the PR:H requirement - this is not reachable by unauthenticated or low-privileged users, so the realistic risk is an administrator (or an actor who has stolen admin credentials) abusing the path traversal to reach command execution. No user interaction is required (UI:N) and attack complexity is low (AC:L). The specific product feature, protocol, or endpoint exercised by the traversal is not described in the available sources. Fixed in 7.13.1.80, 8.3.1.40, 8.6.1.20, and 8.9.0.0; updating is the remediation per the Dell advisory.

This is a moderate-priority, authenticated-administrator vulnerability rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, 7.2 High) is internally consistent with the description: network-reachable, low attack complexity, no user interaction, but requiring HIGH privileges (PR:H). This high-privilege prerequisite is the dominant limiting factor - an attacker must already hold administrative-level access before the path traversal becomes useful, which substantially lowers real-world urgency compared to an unauthenticated flaw of the same score. The vuln.today decision label is 'this_week' (not act_now/emergency), aligning with that assessment. No EPSS score was supplied, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no PoC or exploit reference appears in the input, so there is no public exploit identified at time of analysis. The primary value here is privilege-boundary violation: an admin-level actor converting path traversal into command execution (C:H/I:H/A:H) - effectively escaping intended administrative constraints to full command execution on a backup appliance, which is a high-value target for ransomware actors seeking to destroy recovery capability. Signals are consistent (no conflict between CVSS, decision label, and absence of KEV/PoC); the chief missing signal is EPSS.

An attacker who has already obtained high-privileged (administrative) remote access to a PowerProtect Data Domain Virtual Edition instance submits a request containing crafted path-traversal sequences to a vulnerable interface, escaping the intended directory boundary and causing command execution on the appliance. Because the appliance governs backup and recovery data, successful exploitation could let the attacker tamper with or destroy backups. No public exploit code is identified at time of analysis, and the attacker must already hold high privileges, so this is a privilege-to-command-execution escalation rather than an initial intrusion vector.