PowerProtect Data Domain EUVD-2026-41549

Exploitation requires the attacker to already hold high-privileged (administrative) access to the appliance - CVSS PR:H - and network reachability to the Data Domain management/CLI interface (AV:N); no end-user interaction is needed (UI:N) and attack complexity is low (AC:L). The concrete prerequisite is authenticated admin-level access to a Data Domain management function that passes input into an OS command; the attacker supplies special shell characters into that input to inject commands. The primary limiting factor is the high privilege requirement: an unprivileged or merely network-adjacent attacker cannot trigger it, so realistic risk is confined to malicious admins, stolen/abused administrative credentials, or a chained escalation from a lower-privilege foothold. Affected deployments are any running the listed 7.7.1.0-8.7, 8.6.1.x, 8.3.1.x, or 7.13.1.x versions.

The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - network-reachable and low-complexity, but critically gated by PR:H, meaning the attacker must already possess high (administrative) privileges on the appliance. That single metric is what separates this from a critical unauthenticated RCE: the real-world entry barrier is high, so the practical threat is a malicious or compromised administrator, credential theft, or an attacker who has already escalated to admin. No EPSS score is provided in the input, no SSVC decision is supplied, KEV status is not listed (not actively exploited per available data), and no POC is referenced - all signals point to a genuine but non-emergency priority. The chief value of exploitation is escaping the appliance's restricted management shell into full OS command execution, which can undermine the integrity of backup data and the appliance itself. Note the input does not include an EPSS probability, so widespread-versus-targeted likelihood cannot be quantified from the data given.

An attacker who has obtained high-privilege administrative credentials on a Data Domain appliance - whether an insider, a compromised admin account, or someone who phished management access - connects to the remote management interface and submits a parameter containing shell metacharacters into a command-invoking operation. The injected characters break out of the intended command and execute arbitrary OS commands on the appliance, giving control over the underlying system and the backup protection storage. No public exploit code is identified at time of analysis, and the low attack complexity (AC:L) means that once admin access is held, triggering the flaw is straightforward.