PowerProtect Data Domain EUVD-2026-111974

No special configuration conditions are stated - a hard-coded cryptographic key is present by default in the affected firmware builds, so exploitation does not require any feature to be enabled or non-default setup. The required prerequisite is remote network access to the affected PowerProtect Data Domain appliance (Feature Release 7.7.1.0-8.8, LTS2024 7.13.1.0-7.13.1.80, LTS2025 8.3.1.0-8.3.1.40, LTS2026 8.6.1.0-8.6.1.20). The principal LIMITING factor is that the resulting access is bounded by the 'privileges of the compromised user' tied to the exposed credential, not guaranteed administrative control; network segmentation that prevents reaching the appliance's management interface also limits exposure. The exact mechanism by which the key yields the credentials is not described in the available sources.

This is a genuine high-priority issue, not an inflated high-CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity access, and a Use of Hard-coded Cryptographic Key (CWE-321) is deterministic: once the embedded key is known, exploitation is reliable and repeatable rather than probabilistic, which is why the vuln.today decision label is act_now and Dell self-reported a 9.8. However, several key signals are MISSING and must not be presented as confirmed: no EPSS exploitation-probability score was provided, the CVE is NOT listed in CISA KEV in the supplied data, and no SSVC exploitation/automatable/technical-impact breakdown is given - so there is no evidence of active exploitation, only strong theoretical severity. The C:H/I:H/A:H impact rating should be read against the description's own qualifier that recovered credentials grant 'privileges of the compromised user'; if the exposed credential is low-privileged, the real integrity/availability impact may be lower than 9.8 implies - verify the privilege level of the affected account with Dell. Net: treat as urgent patch per the act_now label, while recognizing exploitation status is currently theoretical, not confirmed in the wild.

A remote attacker with network reachability to the PowerProtect Data Domain appliance leverages the hard-coded cryptographic key - identical across deployments - to decrypt or forge protected material and expose stored credentials, then reuses those credentials to log in with the privileges of the compromised user. Because the key is static and the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is required. No public exploit was identified in the provided data, so this is a plausible path rather than a demonstrated one.