PowerProtect Data Domain EUVD-2026-111976

Exploitation requires an attacker who already holds high privileges (administrative-level access per CVSS PR:H) on the Dell PowerProtect Data Domain appliance and network reachability to it; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific feature, protocol, or interface that processes the overflowing integer is not described in the available sources. The decisive limiting factor is the PR:H prerequisite - without pre-existing high-privilege access the vulnerability cannot be reached - which makes this predominantly a post-authentication/post-compromise protection-bypass risk rather than an externally exploitable one. Affected deployments are those running the listed Feature Release and LTS2024/2025/2026 version ranges.

The signals are moderate and internally consistent rather than alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2) describes a network-reachable, low-complexity flaw that nonetheless requires PR:H - the attacker must already hold high privileges on the appliance before anything can be triggered, which is the dominant limiting factor and the main reason the score stays at High rather than Critical despite full C:H/I:H/A:H impact. There is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of active or probable exploitation; the vuln.today decision label is 'this_week', indicating prioritized but non-emergency remediation. No public exploit or PoC reference is present in the input (the single reference is the Dell advisory itself). This reads as a real-but-gated issue: genuinely remediable this cycle, but the pre-condition of existing high privilege means it is primarily a post-compromise privilege/protection-bypass concern rather than an internet-facing mass-exploitation risk. One caveat to verify: the input Tags include 'Buffer Overflow' while the CWE and description specify only Integer Overflow/Wraparound (CWE-190) leading to a protection mechanism bypass - the mechanism linking the overflow to the bypass is not described in the available sources.

An attacker who has already obtained high-privilege (administrative-level) access to a Dell PowerProtect Data Domain appliance sends crafted input over the network that triggers an integer overflow, causing a wraparound that defeats a protection mechanism on the appliance. Because exploitation needs no user interaction and low attack complexity, the post-authentication step is reliable, but the requirement for pre-existing high privilege strongly narrows who can perform it. No public exploit code is identified in the available data.