Dell PowerProtect Data Domain EUVD-2026-41537

Exploitation requires a high-privileged (administrative) account with remote network access to the Dell PowerProtect Data Domain management interface, as confirmed by the CVSS vector (AV:N/PR:H). This is not exploitable by unauthenticated users or accounts with lower privilege levels - the attacker must hold or have stolen administrator-level credentials. No user interaction is required once credentials are in hand (UI:N). There is no indication from available data that a non-default configuration is required - any affected version with the management interface network-reachable is potentially at risk given valid high-privileged credentials. Key limiting factors are: the mandatory high-privilege credential requirement (substantially narrows exploitable scenarios to insider threats, credential compromise, or post-lateral-movement situations), and the unchanged scope (S:U) meaning impact cannot extend beyond the Data Domain appliance itself through this vulnerability alone.

The CVSS base score of 6.5 (Medium) accurately reflects the PR:H gate - exploitation is strictly limited to high-privileged accounts with remote network access, substantially constraining the realistic attacker population to insiders, credential-compromise scenarios, or lateral movement from an already-privileged management host. The attack complexity is low (AC:L), meaning no special timing, race conditions, or environmental prerequisites are required beyond valid admin credentials. The confidentiality impact is notably absent (C:N), which is somewhat unusual for an OS command injection - this may reflect that the appliance's primary data paths are not exposed via the vulnerable interface, or that the vendor assessed only management-plane impact. Integrity and availability are both fully impacted (I:H/A:H), which for a backup appliance is operationally severe: disruption of Data Domain services can cascade to failed backup and recovery operations across dependent workloads. No EPSS data was provided, and the CVE is not in CISA KEV, indicating no confirmed active exploitation. No public POC is known at time of analysis. The primary realistic threat is a malicious or compromised administrator account; organizations with weak privileged access management, shared admin credentials, or broad administrative access grants face meaningfully higher risk than the CVSS score alone conveys.

An attacker who has obtained high-privileged Data Domain administrator credentials - through phishing, credential stuffing against the management interface, or lateral movement from a compromised management workstation - authenticates remotely and submits a crafted request containing shell metacharacters to a vulnerable management function. The appliance passes the unsanitized input to a system shell call, executing the attacker's injected OS commands with the privileges of the management process. This could be used to disable backup services, corrupt or delete backup data, or establish persistence within the appliance operating system. No public POC exists at time of analysis.