Dell PowerProtect Data Manager versions earlier than 19.22 contain an Incorrect Privilege Assignment flaw that allows a low‑privileged attacker with remote access to gain higher privileges. The vulnerability can lead to unauthorized modification of system configuration, data, or further compromise of the environment.

The affected product is Dell PowerProtect Data Manager for all versions prior to 19.22. Management is typically performed over the network, so users with compromised or weak credentials can launch the attack.

The CVSS score of 8.1 indicates high severity. The EPSS score is reported as less than 1% and the vulnerability is not listed in CISA's KEV catalog, suggesting that exploitation is currently unlikely but possible. Remote attackers who can reach the Data Manager interface and have a low‑privilege account are the likely threat actors. While no exploit is known, the flaw can be abused to elevate privileges and potentially gain full control over the data protection system.