PowerProtect Data Domain EUVD-2026-42038

Exploitation requires network reachability to the affected Dell PowerProtect Data Domain service on a vulnerable DD OS build (mainline 7.7.1.0-8.7, LTS2026 8.6.1.0-8.6.1.10, LTS2025 8.3.1.0-8.3.1.30, or LTS2024 7.13.1.0-7.13.1.70). Per CVSS PR:N/UI:N and Dell's 'unauthenticated attacker with remote access' wording, no authentication and no user interaction are needed against a default-affected appliance. The primary limiting factor is network exposure: the appliance's management/data interface must be reachable by the attacker, so deployments that keep Data Domain on isolated backup/management networks meaningfully reduce reachability. Dell does not cite any non-default feature toggle or specific configuration mode as a prerequisite, so all listed versions should be treated as exploitable until upgraded.

The signals align toward genuine high priority: CVSS 9.8 with a fully remote, low-complexity, unauthenticated, no-interaction vector (AV:N/AC:L/PR:N/UI:N) and full C/I/A impact, reinforced by Dell's own statement that an attacker can take 'complete control of system' and its urgent upgrade recommendation. Countervailing context: there is no EPSS score provided, the vulnerability is not listed in CISA KEV (no confirmed active exploitation), and no public POC is referenced - so the current threat is potential rather than demonstrated. A path-traversal-to-full-control claim is somewhat broader than raw CWE-22 (which typically yields file read/write); Dell's wording implies the traversal chains into code execution or credential/config access, but the exact mechanism is not detailed in available data - treat the 'complete control' outcome as vendor-asserted rather than independently verified. Given the appliance's role as a backup repository, successful exploitation would be high-consequence (ransomware/backup destruction), which raises effective risk even absent EPSS/KEV confirmation.

An attacker who can reach a PowerProtect Data Domain appliance's network-exposed service crafts a request containing directory-traversal sequences to read or write files outside the intended directory, and - because the vector is unauthenticated, low-complexity, and remote (AV:N/AC:L/PR:N) - needs no credentials or user interaction. By leveraging the traversal to access sensitive files or configuration, the attacker escalates to full control of the appliance as Dell describes, potentially compromising or destroying the backups it protects. No public POC is referenced, so this scenario is inferred from the CVSS vector and Dell's impact statement.