The vulnerability is a Missing Authorization flaw that allows a low‑privileged remote attacker to perform unauthorized system operations on Dell PowerProtect Data Domain Management Center managed systems. Because the flaw bypasses normal access controls, an assailant who gains remote connectivity can execute functions normally reserved for authorized users, potentially compromising the integrity and availability of data domain infrastructure. The weakness is identified as CWE‑862.

Affected versions are Dell PowerProtect Data Domain Management Center Feature Release 7.7.1.0 through 8.8, the LTS2024 releases 7.13.1.0 through 7.13.1.80, the LTS2025 releases 8.3.1.0 through 8.3.1.40, and the LTS2026 releases 8.6.1.0 through 8.6.1.20.

The CVSS score of 9.6 indicates a high‑severity, potentially critical risk. The EPSS score is not available, so the current probability of exploitation is unknown, but the lack of KEV listing suggests no widespread active exploitation has been documented. An attacker only needs remote access and low privileges; no special configuration or insider knowledge is indicated, implying a relatively straightforward attack path once remote connectivity is granted. Immediate patching is therefore strongly advised.