Dell PowerProtect Data Domain EUVD-2026-111853

Per the supplied CVSS vector (AV:N/AC:L/PR:N/UI:N), exploitation requires only remote network access to the PowerProtect Data Domain management/service interface with no authentication and no user interaction. The specific triggering feature, protocol endpoint, or parameter is not described in the available sources, so the exact request path cannot be named. Limiting factors: impact is confined to confidentiality at Low (C:L) - read-level filesystem access only, with no write/integrity or availability impact - and exploitation presupposes that the appliance's network interface is reachable by the attacker, so appliances isolated on a management network are correspondingly harder to reach.

Signals are consistent but point to a moderate, not critical, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3) describes a network-reachable, low-complexity, unauthenticated flaw whose only impact is low-confidentiality (C:L) - read-level filesystem access with no integrity or availability impact. The vuln.today decision label is 'this_month' (not act_now/emergency), which aligns with a patch-available, limited-impact bug rather than an urgent crisis. There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active exploitation or a measured exploitation probability; this is not confirmed actively exploited. No public exploit or PoC reference is present in the input. The main thing elevating attention is the unauthenticated, remote nature against a widely-deployed backup appliance - a path-traversal read on a data-protection system could expose sensitive configuration or stored data. Net: a genuine but contained priority - patch on a normal (this_month) cadence, not an emergency. Note the input provides no EPSS value, so probabilistic exploitation likelihood cannot be assessed from the data.

A remote, unauthenticated attacker sends a crafted request to a network-exposed PowerProtect Data Domain interface containing directory-traversal sequences that escape the intended restricted directory, causing the appliance to disclose the contents of files outside that directory. Because the CVSS confidentiality impact is only Low (C:L) with no integrity or availability impact, the realistic outcome is unauthorized reading of files rather than modification or code execution. No public exploit or PoC was identified at time of analysis.