Dell PowerProtect One EUVD-2026-66666

Exploitation requires possession of a valid low-privileged account on the Dell PowerProtect One platform, as confirmed by the CVSS PR:L metric - unauthenticated exploitation is not supported by the available data. The attacker must have remote network access to the management interface (CVSS AV:N). No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning no special timing, race conditions, or non-default configurations are prerequisites beyond the authenticated session. The primary limiting factor is credential acquisition: if account creation is tightly controlled and the management interface is not exposed beyond a trusted administrative network, exploitation surface is substantially reduced. The vulnerability does not require administrator or operator-level privileges - standard read-level or operator-level accounts are sufficient based on the PR:L rating.

The CVSS 8.8 High score reflects a genuinely elevated risk profile: AV:N confirms remote exploitability, AC:L means no special conditions or race conditions are required, and PR:L means only a low-privileged account is needed - not administrator or root. The full C:H/I:H/A:H triad indicates complete system compromise is possible upon successful exploitation. No EPSS score was provided, and the vulnerability is not currently listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. However, the low barrier to exploitation (low privileges, no complexity) means this vulnerability is highly automatable once a credential is obtained. For organizations exposing PowerProtect One management interfaces beyond internal networks, or with untrusted low-privileged users, this represents a real and immediate priority. The absence of an exact fixed version in the available data introduces minor uncertainty around patch confirmation.

An attacker with a low-privileged account on the Dell PowerProtect One management interface submits a crafted HTTP request to a vulnerable management endpoint, embedding OS command injection sequences (e.g., semicolon-separated shell commands or backtick substitution) within an input parameter that the application passes unsanitized to a system call. The backend executes the injected command with the privileges of the application process, enabling the attacker to read sensitive data, install backdoors, or disrupt backup and recovery operations. No public proof-of-concept has been identified at time of analysis.