PowerProtect Data Domain CVE-2026-94347

Exploitation requires the attacker to already possess a high-privileged (administrative-level) account on the PowerProtect Data Domain Virtual Edition system, consistent with PR:H in the CVSS vector; it is then performed remotely (AV:N) with low complexity (AC:L) and no user interaction (UI:N). The exact feature, command, or process-control mechanism that is manipulated to achieve the protection-mechanism bypass is not described in the available sources. Limiting factors for defenders: the mandatory high-privilege precondition sharply narrows the realistic attacker set to insiders or adversaries who have already compromised privileged credentials, and the affected scope is limited to the listed Feature Release (7.7.1.0-8.7), LTS2024 (7.13.1.0-7.13.1.70), LTS2025 (8.3.1.0-8.3.1.30), and LTS2026 (8.6.1.0-8.6.1.10) version ranges.

This is a genuine but bounded-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) shows the flaw is reachable over the network with low attack complexity and no user interaction, but it explicitly requires high privileges (PR:H) - so the attacker must already hold an elevated/administrative account on the PowerProtect Data Domain Virtual Edition system before anything can be exploited. That precondition is the single most important mitigating factor and keeps this well short of a mass-exploitable, unauthenticated flaw. Exploitation status: no public exploit identified at time of analysis - the input provides no KEV listing, no POC/exploit reference, and no EPSS score, so there is no evidence of active exploitation or public exploit code; absence of these signals is not proof of safety but does lower immediate urgency. The vuln.today decision label is 'this_week', which aligns with a high-impact (C:H/I:H/A:H) but privilege-gated weakness: patch within the normal prioritized cycle rather than as an out-of-cycle emergency. SSVC-style framing is not provided in the input, so automatable/technical-impact decision metrics cannot be cited. Note a metadata tension: the Tags label this 'Authentication Bypass', but the description and CWE-114 (Process Control) describe a 'Protection mechanism bypass' triggered by an already-high-privileged actor - these are not the same thing, and the tag should be treated with caution (see confidence notes).

An attacker who has already obtained a high-privileged (administrative) account on a PowerProtect Data Domain Virtual Edition appliance connects to it over the network and abuses the process-control weakness to bypass a protection mechanism - potentially neutralizing safeguards that protect backup data integrity or retention. Because no user interaction is needed and attack complexity is low, the action is straightforward once the privileged foothold exists. No public exploit code or proof-of-concept is referenced in the available data.