CVE-2026-46730: Dell PowerProtect Data Domain Authorization Bypass – Local Privilege Escalation

Technical summary

CVE-2026-46730 is an incorrect authorization vulnerability (CWE-863) in Dell PowerProtect Data Domain's access control mechanisms. The flaw permits a high-privileged user with local access to bypass intended authorization checks and execute arbitrary commands with elevated permissions. The vulnerability spans four release families: standard versions 7.7.1.0–8.7, LTS2026 (8.6.1.0–8.6.1.10), LTS2025 (8.3.1.0–8.3.1.30), and LTS2024 (7.13.1.0–7.13.1.70). The CVSS 3.1 score of 4.2 reflects local-only attack surface with high privilege requirement, though impact encompasses confidentiality, integrity, and availability compromise.

Business impact

Unauthorized command execution within a Data Domain appliance can compromise backup integrity, enable credential harvesting from protected datasets, or facilitate lateral movement into backup-dependent production environments. For organizations relying on Data Domain for ransomware recovery or regulatory compliance, this vulnerability could undermine backup validation controls and create undetected persistence points. The breach of authorization controls is particularly concerning given that Data Domain systems often hold copies of an organization's most sensitive data.

Affected systems

Dell PowerProtect Data Domain deployments across all currently supported release streams are affected: the general release line (7.7.1.0–8.7), LTS2026 (8.6.1.0–8.6.1.10), LTS2025 (8.3.1.0–8.3.1.30), and LTS2024 (7.13.1.0–7.13.1.70). Organizations running versions outside these ranges or those already patched beyond these boundaries are not affected. Verify your current version in the Data Domain administrative console under 'System Information.'

Exploitability

Exploitation requires both high privilege (administrative or equivalent role) and local access to the Data Domain system, significantly limiting the practical attack surface. Remote exploitation is not possible. An attacker must already possess elevated credentials and network or physical access to the appliance console or management interface. However, once an insider or compromised high-privilege account is present, the authorization bypass is trivial to exploit—no special tooling or complexity is required, only knowledge of available commands.

Remediation

Dell has released patched versions across all affected release branches. Organizations must identify their current release line and apply the corresponding vendor patch. No workarounds are documented; patching is the primary mitigation. Temporary controls include restricting administrative access to trusted personnel, enforcing multi-factor authentication for administrative logon, and monitoring command execution logs for suspicious activity from high-privileged accounts.

Patch guidance

Consult Dell's official security advisory for your specific release branch to identify the patched version number applicable to your deployment. Patches are cumulative within each release family. Plan patching during maintenance windows to avoid backup service interruptions. Verify patch installation by confirming the appliance version string in the system settings post-update. Dell typically provides version-specific release notes documenting bug fixes and security updates alongside each patch.

Detection guidance

Monitor Data Domain audit logs for command execution events originating from high-privilege accounts, especially commands inconsistent with normal administrative workflows. Alert on authorization rejection events followed by successful execution of the same command (indicator of bypass attempt). Review privileged account activity during off-hours or from unusual source IPs. Implement integrity checks on backup metadata and configuration files to detect unauthorized modifications. SIEM integration of Data Domain audit logs enhances visibility into authorization anomalies.

Why prioritize this

While the CVSS score is moderate (4.2), the vulnerability affects a critical infrastructure component—backup systems that organizations depend on for business continuity and incident response. The requirement for high privilege and local access reduces immediate risk, but the ease of exploitation once access is obtained, combined with the strategic value of backup systems as both targets and pivot points, warrants prompt patching. Organizations should prioritize this based on their backup operational risk tolerance and whether high-privilege account compromise is already a threat model concern.

Risk score, explained

The CVSS 3.1 score of 4.2 (MEDIUM) reflects: Attack Vector Local (AV:L) because local access is mandatory; Attack Complexity Low (AC:L) because exploitation is straightforward; Privileges Required High (PR:H) because administrative credentials are needed; and modest impact scope (Confidentiality, Integrity, Availability all Low to Partial) because damage is scoped to the appliance itself. The score does not fully capture organizational risk if backup systems are heavily relied upon for recovery or if high-privilege compromise is a known threat; security leaders should apply business context when prioritizing.

Frequently asked questions