Powerprotect Data Domain Appliances EUVD-2026-23392

Exploitation requires four specific prerequisites: (1) the retention lock compliance feature must be enabled on the PowerProtect Data Domain appliance (a non-default enterprise configuration used for regulatory compliance), (2) attacker must possess existing low-privileged authenticated access to the DD OS management interface (PR:L), (3) attacker must gain access to system log files where credentials are recorded (typically requiring file system read permissions), and (4) a high-privileged DD OS administrator must authorize an authentication attempt by the compromised user account (UI:R). These conditions limit exploitation to insider threat scenarios or environments where attackers have already achieved initial compromise with low-privileged credentials. Systems without retention lock enabled are not vulnerable. Default DD OS installations without retention lock are not affected.

Real-world risk assessment reveals moderate exposure despite the 7.6 CVSS score. The CVSS vector indicates network accessibility (AV:N) with low attack complexity (AC:L), suggesting straightforward exploitation once prerequisites are met. However, multiple limiting factors constrain practical risk: (1) attackers need existing low-privileged authenticated access (PR:L), (2) high-privileged administrator interaction is required (UI:R) to authorize authentication attempts using harvested credentials, and (3) the vulnerability only manifests when retention lock is enabled-a non-default enterprise compliance feature. EPSS probability of 0.01% (2nd percentile) aligns with these constraints, indicating security researchers assess exploitation likelihood as very low. SSVC framework classification confirms 'non-automatable' exploitation and 'partial' technical impact. No active exploitation confirmed (SSVC: Exploitation=none). The CVSS Integrity and Availability impacts (I:H/A:H) reflect potential post-exploitation consequences if attackers successfully authenticate as compromised high-privileged users, but the Confidentiality impact remains Low (C:L) as only credential exposure occurs initially. This is a real but constrained risk-prioritize patching on systems with retention lock enabled and accessible to low-trust users.

A low-privileged remote attacker with legitimate access to a Dell PowerProtect Data Domain appliance leverages their authenticated session to access system log files where sensitive authentication credentials are inadvertently recorded due to the logging vulnerability. The attacker extracts high-privileged user credentials from these logs, then waits for an opportunity where a high-privileged DD administrator authorizes an authentication attempt-either through social engineering, timing the attack during maintenance windows, or exploiting administrative workflows. Once authorized, the attacker authenticates using the harvested credentials to gain high-privileged access, enabling significant integrity and availability impacts to the backup infrastructure.