CVE-2026-46466: Dell PowerProtect Data Domain Information Tampering Vulnerability

Technical summary

This vulnerability (CWE-348: Use of Less Trusted Source) allows a high-privileged remote attacker to tamper with information on affected Dell PowerProtect Data Domain systems. The attack vector is network-based and requires high privileges but no user interaction. The CVSS v3.1 vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) reflects a low overall score of 2.7, meaning integrity impact is limited and there is no confidentiality or availability loss. The vulnerability exists in Data Domain Operating System versions 7.7.1.0 through 8.7, as well as in LTS2026 (8.6.1.0–8.6.1.10), LTS2025 (8.3.1.0–8.3.1.30), and LTS2024 (7.13.1.0–7.13.1.70) releases.

Business impact

The primary business risk is data integrity compromise on backup and deduplication appliances. PowerProtect Data Domain is typically deployed as a critical backup target; a high-privileged attacker gaining remote access could alter backup metadata, restore points, or configuration information. This could undermine backup reliability and complicate incident response or recovery operations. The low CVSS score reflects that this requires existing high-privilege access, which limits the threat surface significantly. Organizations should assess the likelihood of a compromised admin account within their infrastructure, as well as whether third-party integrations with Data Domain might grant elevated privileges to less-controlled systems.

Affected systems

Dell PowerProtect Data Domain Operating System is affected across a broad version range: mainline versions 7.7.1.0 through 8.7 (inclusive), plus three LTS release streams: LTS2026 (8.6.1.0–8.6.1.10), LTS2025 (8.3.1.0–8.3.1.30), and LTS2024 (7.13.1.0–7.13.1.70). Organizations should verify their exact build version via the Data Domain web interface or CLI before determining exposure. If you are on an unsupported version, the risk is heightened because vendor updates may not be available.

Exploitability

Exploitability is constrained by the requirement for high-privileged credentials. An attacker must first obtain or already possess administrator or equivalent-level access to the Data Domain system to trigger this flaw. The network-based attack vector means the exploit can be performed remotely without physical access, but the high-privilege barrier limits opportunistic attack likelihood. This is not a privilege-escalation vulnerability; it requires pre-existing admin rights. Organizations with strong access controls, multi-factor authentication on administrative accounts, and monitoring of privileged actions should find this risk manageable. However, lateral movement from a compromised workstation with Data Domain management credentials would enable exploitation.

Remediation

Dell has released updates to address this vulnerability. Verify the patched versions against Dell's official security advisory to confirm which releases contain fixes. Organizations should prioritize patching based on their environment's criticality and access control maturity. For systems in highly restricted environments with limited remote admin access, interim risk mitigation includes: restricting network access to Data Domain management interfaces, requiring multi-factor authentication for admin login, and implementing comprehensive audit logging of administrative actions. Patch application is the definitive remediation.

Patch guidance

Consult Dell PowerProtect Data Domain security advisories and product documentation for the specific patched version numbers for each release stream (mainline, LTS2026, LTS2025, LTS2024). Test patches in a non-production environment first, particularly given that Data Domain is often mission-critical to backup operations. Plan patching during a maintenance window to minimize disruption. Verify post-patch operation by confirming system health and backup/deduplication functionality. Maintain backups of the Data Domain configuration before applying updates.

Detection guidance

Monitor Data Domain audit logs for unusual administrative login activity, especially from unexpected IP addresses or outside normal maintenance windows. Track changes to backup policies, deduplication settings, or metadata—these may indicate tampering. Correlate Data Domain admin access logs with endpoint detection systems to identify whether admin credentials were used from compromised workstations. Enable and review authentication logs for failed login attempts and privilege usage. Implement alerting on any modifications to critical backup metadata or recovery points that have no corresponding change request.

Why prioritize this

Although the CVSS score is low (2.7), this vulnerability warrants timely attention because it directly affects data integrity on a system trusted to protect critical backups. The requirement for high privileges reduces urgency compared to pre-auth flaws, but the impact—potential tampering with backup data—could be severe in a post-incident forensics scenario. Prioritize patching based on whether your Data Domain systems are accessible from less-trusted network segments or support integrations with third-party tools that might grant elevated privileges. Low-risk deployments in air-gapped or highly restricted environments may defer patching longer than internet-facing or integration-heavy setups.

Risk score, explained

The CVSS v3.1 score of 2.7 (LOW) reflects that this vulnerability requires high-privilege access and produces only an integrity impact on the local system (no confidentiality loss, no availability loss, no scope change). The network-based attack vector elevates concern somewhat, but the high-privilege prerequisite is a significant mitigating factor. Context matters: in an environment with weak access controls or many admin users, the risk is higher; in a locked-down environment with MFA and minimal admin access, the risk is lower.

Frequently asked questions