PowerProtect Data Domain EUVD-2026-41542

Exploitation requires an attacker to already possess high-privileged (PR:H) local access to the Data Domain appliance - specifically, a shell-level account with sufficient OS permissions to create symbolic links in directories used by the vulnerable application. The attack is limited to the local system (AV:L), ruling out remote unauthenticated exploitation. The vulnerability does not require user interaction. Limiting factors include: (1) the attacker must already hold high OS-level privileges on the appliance, (2) access must be local (console or authenticated remote shell), and (3) the attacker must be able to write to a directory that the vulnerable process traverses. Environments that enforce strict privileged access management and limit direct shell access to Data Domain nodes significantly reduce realistic exploitability despite the Low attack complexity rating.

The CVSS 3.1 base score of 4.4 (Medium) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N accurately reflects the constrained threat model: exploitation requires physical or remote shell access with high OS-level privileges, which significantly limits the attacker pool. Despite the High confidentiality impact (C:H), the requirement for PR:H means an attacker already possessing elevated local access is needed - substantially reducing real-world risk for well-managed environments with strict privileged access controls. EPSS data was not provided in the input; without it, probability-based prioritization cannot be performed. No CISA KEV listing and no POC availability further support treating this as a lower-urgency hardening issue rather than an emergency patch. The primary realistic concern is insider threat or post-compromise lateral privilege escalation on the appliance itself. No conflicting signals between the CVSS vector and the description were identified.

A local administrator or backup operator with an elevated shell session on the Data Domain appliance creates a symbolic link in a directory traversed by a privileged system process, redirecting file access to a sensitive target such as an internal configuration file containing credentials or encryption key references. When the vulnerable process accesses the symlink target without validation, its contents are exposed to the attacker. No public exploit code has been identified at time of analysis.