PowerProtect Data Domain EUVD-2026-41543

Exploitation requires a local account on the Data Domain appliance with at least low-level OS privileges (PR:L per CVSS). The high attack complexity (AC:H) indicates a specific operational condition must be present or triggered to cause sensitive data to be written to the log - the exact triggering state is not specified in available data but likely relates to a particular management operation, job execution, or error path. The attacker must have filesystem read access to the relevant log file or log directory. Exploitation is limited to: (1) local system access only - remote network exploitation is not possible per AV:L; (2) requirement for low-privilege credentials on the appliance; (3) necessity of meeting the high-complexity triggering condition; and (4) knowledge of which log file(s) contain the sensitive output. The I:L and A:L ratings in the vendor CVSS suggest minor secondary effects, though the primary impact is confidentiality.

The NVD-assigned CVSS 5.8 (Medium) reflects a balanced but real risk profile. The local attack vector (AV:L) and high complexity (AC:H) substantially limit opportunistic exploitation - an attacker must already have a foothold on the appliance with at least low-privilege OS access, and must trigger the specific operational condition that causes sensitive data to be logged. However, the C:H rating signals that what ends up in the log could be fully sensitive (e.g., plaintext credentials or encryption keys), making successful exploitation highly impactful for lateral movement or data exfiltration. No EPSS data was provided in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified. KEV status is negative and no POC is known, meaning this is not being mass-exploited. The realistic priority is elevated for organizations where Data Domain appliances are accessed by multiple admin tiers or service accounts, or where log aggregation pipelines may expose log content to broader audiences than intended.

An attacker who has compromised a low-privileged local account on the Data Domain appliance - for example, a service account used for monitoring - waits for or triggers an operational condition (such as initiating a backup job or configuration operation) that causes the system to log sensitive material such as credentials or tokens. The attacker then reads the relevant log file from the local filesystem, extracting the sensitive information for use in further lateral movement or escalating access within the backup infrastructure. No public exploit code exists at time of analysis, so exploitation is currently limited to threat actors with sufficient knowledge of the specific logging condition.