A critical path traversal vulnerability in Dell PowerProtect Data Domain allows unauthenticated remote attackers to gain unauthorized access and potentially full control of the system.

This is an improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability. It allows an unauthenticated remote attacker to traverse the file system, leading to unauthorized data access or system compromise.

The CVSS score of 9.8 underscores the critical impact of this vulnerability. Unauthorized access to a backup and data protection appliance like PowerProtect Data Domain can lead to the exposure, modification, or deletion of critical business backups, resulting in severe data loss and total system compromise.

Immediate Action: Upgrade to the latest remediated versions as specified in Dell security advisory DSA-2026-278.

Proactive Monitoring: Monitor system logs for path traversal patterns (e.g., ../ strings) and unauthorized access attempts to the management interface.

Compensating Controls: Ensure the management interface of the PowerProtect Data Domain is not exposed to the public internet and limit access to trusted network segments only.

Public Exploit Available: False

Given the critical nature of backup infrastructure, this vulnerability must be treated with the highest priority. Organizations should apply the required firmware/software updates immediately to prevent potential data destruction or system takeover by malicious actors.