PowerProtect Data Manager EUVD-2026-47734

Exploitation requires the attacker to first hold valid low-privileged credentials on the PowerProtect Data Manager instance (CVSS PR:L confirms authentication is needed - this is not an unauthenticated attack) and network reachability to the management interface (AV:N). The specific vulnerable mechanism is the IAM security-token generation path, so the attacker must be able to invoke the token-issuance/authorization flow as an authenticated user; no user interaction (UI:N) and no unusual configuration are required, and attack complexity is low (AC:L). The principal limiting factor is therefore the need for a pre-existing low-tier account and network access to the appliance - an environment that restricts account provisioning and isolates the management plane materially reduces exposure. The affected build is any version below 20.2.0.0.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with high impact across all three security properties - a realistic and attractive target for an insider or any actor who has obtained a low-tier account. Countervailing signals lower the immediate urgency: there is no EPSS score supplied, no public exploit identified at time of analysis, no proof-of-concept referenced, and the CVE is not in CISA KEV, so there is no evidence of active or automatable exploitation yet. No SSVC decision data was provided. The realistic picture is a genuinely high-severity privilege-escalation bug whose exploitation currently depends on an attacker first holding valid low-privileged credentials; treat it as a real patch priority for a backup/DR platform (high-value target) but not a drop-everything zero-day, and note that EPSS and SSVC inputs are missing rather than confirmed-low.

An attacker who already holds a low-privileged PowerProtect Data Manager account (an insider, a contractor, or someone who phished a junior operator) authenticates remotely over the network and triggers the IAM flaw so that the token issued to them carries elevated authorization claims. Using that improperly generated token, they perform administrative actions - altering or deleting backup policies, exfiltrating protected data, or disabling recovery points. No public exploit is identified at time of analysis, and the low attack complexity means no special timing or environmental conditions are needed beyond having valid low-tier credentials.