PowerProtect Data Domain EUVD-2026-41548

Exploitation requires the attacker to already hold a high-privileged (administrative) account on the PowerProtect Data Domain appliance, as reflected by PR:H in the CVSS vector - this is the primary limiting factor and means the flaw is not exploitable by anonymous or low-privileged users. The attack vector is network (AV:N), so the vulnerable management interface must be reachable over the network from the attacker, but no user interaction (UI:N) and low complexity (AC:L) are needed once authenticated. The specific injectable feature/parameter is not detailed in the available data; the CVE describes command injection reachable by 'a high privileged attacker with remote access,' so the concrete prerequisite is authenticated administrative access to the DDOS management plane on an affected version. Realistic risk is bounded by how well administrative access and management-network exposure are controlled.

The signals are moderately, not critically, alarming. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, 7.2 High) shows network-reachable, low-complexity exploitation with full CIA impact, but crucially requires PR:H - an already high-privileged (administrative) account - which sharply narrows the realistic attacker population and makes this primarily a privilege-boundary/defense-in-depth issue rather than a remote-unauthenticated compromise. It is not in CISA KEV (no confirmed active exploitation) and no public exploit was identified, so this is not an emergency drop-everything patch. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The main real-world value of exploitation is that it converts application-level admin access into OS-level command execution on a backup appliance - a high-value pivot for ransomware actors seeking to destroy backups - which justifies prompt but scheduled patching rather than crisis response. Because backup appliances are attractive targets, treat any admin credential exposure on these systems as amplifying this bug's impact.

An attacker who has obtained (or abused) a high-privileged administrative account on a Data Domain appliance - for example via stolen admin credentials or an insider - submits a crafted value containing shell metacharacters to a management CLI/API operation that passes input to an OS command. The injected command executes on the appliance OS with elevated privileges, enabling the attacker to tamper with or destroy backup data, disable protection, or pivot deeper into the backup infrastructure. No public exploit code is currently identified, and low attack complexity (AC:L) means exploitation is straightforward once admin access is held.