CVE-2026-46465: Dell PowerProtect Data Domain Format String Vulnerability (CVSS 5.5)

Technical summary

CVE-2026-46465 is a CWE-134 (use of externally-controlled format string) vulnerability in Dell PowerProtect Data Domain. Affected versions span multiple release branches: standard support versions 7.7.1.0–8.7, LTS2026 releases 8.6.1.0–8.6.1.10, LTS2025 releases 8.3.1.0–8.3.1.30, and LTS2024 releases 7.13.1.0–7.13.1.70. The vulnerability allows a high-privileged remote attacker to supply a specially crafted format string input that reads or corrupts memory, resulting in information disclosure or denial of service. The CVSS 3.1 score of 5.5 reflects the high privilege requirement (PR:H) combined with measurable confidentiality and availability impacts.

Business impact

PowerProtect Data Domain is commonly deployed as a deduplication and archival platform in enterprise backup environments. Exploitation could result in exposure of sensitive backup metadata or restore failures, compromising recovery capabilities during incident response or data restoration scenarios. The denial-of-service component poses operational risk to backup windows and recovery time objectives (RTO).

Affected systems

Dell PowerProtect Data Domain installations across four active release branches are affected. Organizations should identify instances running any version from 7.7.1.0 through 8.7 in standard support, or any LTS2024, LTS2025, or LTS2026 version within their respective vulnerable ranges. Both on-premises and cloud-deployed instances require assessment.

Exploitability

The attack requires high privilege (administrative or equivalent role) and remote network access, which significantly constrains real-world attack scenarios. An insider threat with legitimate administrative credentials or an attacker who has compromised an administrative account represents the primary risk vector. The absence of user interaction (UI:N) means the attack can be automated once privilege is obtained. Exploit code has not been observed in public repositories or security research disclosures as of the publication date.

Remediation

Dell has released patches for all affected release branches. Verify the specific patched version available for your release branch by consulting Dell's security advisory. Standard support versions should be updated to a patched release beyond 8.7; LTS2026 users should target a patched version beyond 8.6.1.10; LTS2025 users should target beyond 8.3.1.30; and LTS2024 users should target beyond 7.13.1.70. Validate patch availability against your vendor advisory before scheduling maintenance.

Patch guidance

Obtain the latest security patches from Dell's support portal aligned with your deployment's release branch. Plan patching during scheduled maintenance windows, as updates typically require service restarts. Test patches in a pre-production environment to confirm compatibility with your backup workflows and any third-party integrations. For LTS customers, verify that the patched version remains within your long-term support commitment before deploying.

Detection guidance

Monitor PowerProtect Data Domain logs for suspicious format string payloads in remote procedure calls or API inputs, particularly those containing unusual escape sequences (%x, %s, %n) from privileged users. Implement network segmentation to restrict administrative access to Data Domain interfaces. Enable detailed audit logging for all privileged operations and review access logs for unexpected administrative activity. Organizations using SIEM solutions can correlate authentication events with API calls exhibiting format string characteristics.

Why prioritize this

Although the CVSS score is moderate (5.5) and exploitation requires high privilege, the criticality of backup infrastructure in business continuity planning elevates the risk. A successful attack could undermine data recovery capabilities during an active incident, compounding the impact of the primary breach or failure. The broad version range affected and the presence of LTS releases mean many organizations likely carry this vulnerability in production. Prioritize patching if your environment has strict network isolation of administrative access; consider it routine if administrative interface exposure is possible.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a medium severity rating driven by the high privilege prerequisite (PR:H), which substantially mitigates risk in well-segmented networks. However, the confidentiality impact (partial information disclosure) and high availability impact (denial of service) indicate measurable harm if exploited. The network-accessible nature (AV:N) ensures the vulnerability is not purely local. Organizations should weight this score against their specific threat model: those with strong privilege boundaries and administrative access controls may assess risk lower, while those with permissive internal trust models should assess risk higher.

Frequently asked questions