PowerProtect Data Domain EUVD-2026-110759

Exploitation requires the attacker to already possess a high-privileged account on the Dell PowerProtect Data Domain appliance (CVSS PR:H), reached over its remote/network management interface (AV:N); no user interaction is needed (UI:N) and attack complexity is low (AC:L) once that privilege is held. The principal limiting factor is the prerequisite high-privilege authentication - this is a privilege-escalation flaw usable only by an already-trusted operator, not by an unauthenticated remote attacker. Affected deployments are Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0-7.13.1.80, LTS2025 8.3.1.0-8.3.1.40, and LTS2026 8.6.1.0-8.6.1.20; Dell lists fixed versions 8.9.0.0, 8.3.1.50, 8.6.1.30, and 7.13.1.90, and vendor patching is the stated remediation.

This is a moderate-severity, lower-urgency issue despite its enterprise-critical product footprint. The CVSS 3.1 base score of 6.7 (AV:N/AC:L/PR:H/UI:N) is driven almost entirely by the high impact (C:L/I:H/A:H) rather than by ease of access: the vector explicitly requires PR:H, meaning the attacker must already hold high privileges on the system before escalating further. This is corroborated by the CWE-269 (Improper Privilege Management) classification and the Dell description, which states a 'high privileged attacker with remote access' could achieve elevation of privileges. The required precondition of existing high privilege substantially narrows the real-world threat population - this is a privilege-boundary weakening for an already-trusted operator, not an open remote-takeover flaw. No EPSS score was provided in the input, and there is no CISA KEV listing and no PoC reference, so exploitation probability signals are absent rather than low; the only supplied prioritization signal is the vuln.today Decision label of 'this_month', consistent with a patch-available, non-emergency issue. The main reason this warrants attention beyond its mid-range score is the asset: Data Domain is a backup/recovery platform, so integrity and availability compromise (I:H/A:H) directly threatens an organization's last line of ransomware/recovery defense. No conflicting signals are present, but note the EPSS value is simply not in the dataset - treat exploitation likelihood as unquantified rather than assume it is low.

An attacker who has already obtained a high-privileged (but not top-level) account on a Dell PowerProtect Data Domain appliance - for example a compromised administrative operator or a lower-tier admin role - leverages the improper privilege management flaw over the remote management interface to elevate to full control of the backup system. This would let them tamper with or destroy backup data (I:H/A:H), undermining recovery capability. No public exploit or PoC reference is present in the supplied data, and the specific trigger mechanism is not described in the available sources.