CVE-2026-46464: Dell PowerProtect Data Domain Link Following Information Disclosure

Technical summary

This vulnerability (CWE-59: Improper Link Resolution Before File Access) involves insufficient checks on symbolic links or junction points before file operations occur. When a high-privileged user or compromised administrative account accesses certain file operations on the Data Domain appliance, an attacker could craft malicious link structures to redirect file access to unintended locations. The lack of proper link resolution validation allows information residing outside the intended access boundary to be read. This is classified as a confidentiality issue with no impact to system integrity or availability. The CVSS v3.1 score of 4.9 (MEDIUM) reflects the high privilege requirement and network accessibility, with the primary risk being unauthorized information disclosure.

Business impact

For organizations relying on PowerProtect Data Domain as a backup and deduplication platform, this vulnerability poses a confidentiality risk to backup metadata, retention policies, and potentially sensitive data structures. While the attack vector requires high privilege (administrative or equivalent access), a compromised administrative account or insider threat could exploit this to access restricted backup information or operational details not normally exposed. Given that Data Domain handles critical backup assets, unauthorized disclosure could expose information about backup schedules, retention, or data content that supports compliance auditing and forensic investigation.

Affected systems

The vulnerability affects Dell PowerProtect Data Domain across four distinct release tracks: current versions 7.7.1.0 through 8.7; LTS2026 (8.6.1.0–8.6.1.10); LTS2025 (8.3.1.0–8.3.1.30); and LTS2024 (7.13.1.0–7.13.1.70). Organizations running any version within these ranges should assess their exposure. Check your current Data Domain version via the system console or administrative interface to determine if your deployment falls within the affected ranges.

Exploitability

Exploitation requires high-privileged access and network connectivity to the Data Domain appliance. This significantly raises the barrier compared to unauthenticated remote exploits. The attack surface is limited to users or processes with administrative credentials. However, in environments where administrative accounts are shared, insufficiently isolated, or where account compromise occurs, the risk increases. This is not a wormable or zero-day-equivalent scenario; rather, it is a logic flaw that assumes proper link validation has occurred. No public exploit code or active exploitation has been indicated in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Dell has released patches for affected versions. Consult Dell's security advisory to identify the specific patch versions for your release track (current, LTS2026, LTS2025, or LTS2024). Patches introduce proper link resolution validation before file access. Apply updates in a controlled maintenance window, as Data Domain systems often serve critical backup operations. Prioritize patching systems that handle sensitive or regulated data. Concurrent remediation strategy: enforce strict access controls limiting administrative credentials, implement privileged access management (PAM) solutions, and monitor file access patterns on Data Domain appliances for anomalous link-following behavior.

Patch guidance

Verify the specific patched version for your release track via Dell's official security advisory. Current main-line versions and each LTS track have distinct patch versions. Schedule patching during a maintenance window that accounts for backup schedules and recovery objectives. Test patches in a staging environment first if possible, particularly to confirm no regression in deduplication or backup operations. After patching, validate that backup and restore functionality remains unaffected. Document the patch version applied for audit and compliance purposes.

Detection guidance

Monitor Data Domain audit logs and file access traces for unusual symlink or junction point creation by administrative users, particularly in system directories or metadata regions. Look for access attempts that traverse unexpected directory boundaries or follow unusual link paths. Network-level detection is limited since the flaw is exploited via authenticated administrative sessions; focus on behavioral anomalies in administrative activity and file system audit logs. Consider enabling enhanced logging on systems holding highly sensitive backup data. Correlation of administrative login timestamps with unusual file access patterns may reveal compromise.

Why prioritize this

Although the CVSS score is MEDIUM (4.9), prioritization depends on your environment's risk profile. Systems handling regulated data (healthcare, financial, government) should prioritize patching to meet compliance confidentiality requirements. Systems with high-sensitivity backup content or those exposed to privileged-user compromise risk warrant earlier remediation. Organizations with mature PAM controls and strict credential isolation can defer patching to a scheduled cycle; however, all affected systems should be patched within a 90-day window to maintain a defensible posture.

Risk score, explained

The CVSS v3.1 score of 4.9 reflects a MEDIUM severity rating driven by: (1) Network Attack Vector (AV:N) — accessible remotely but requiring high privilege; (2) High Privilege Requirement (PR:H) — the primary limiting factor, substantially reducing risk compared to low-privilege exploits; (3) No User Interaction (UI:N) — once a privileged user initiates file operations, no additional user action is required; (4) High Confidentiality Impact (C:H) — sensitive information can be disclosed; (5) No Integrity or Availability Impact (I:N, A:N) — data cannot be modified or systems disrupted. The privilege requirement prevents a higher score despite the confidentiality exposure.

Frequently asked questions