The vulnerability is an Improper Authentication flaw that allows an unauthenticated attacker with remote access to create a high‑privilege account. Once the attacker establishes such an account, they can act with full control of the Dell PowerProtect Data Domain system, effectively bypassing all security controls. The flaw is categorized as CWE‑862 and is rated a critical severity with a CVSS score of 9.8.

Dell PowerProtect Data Domain feature release versions 7.7.1.0 through 8.8 and the LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, and LTS2026 release versions 8.6.1.0 through 8.6.1.20 are affected.

Given the CVSS score of 9.8, the vulnerability is considered extremely severe. Although no EPSS score is available, the lack of listing in CISA’s KEV catalog does not diminish the risk. The attack vector is remote unauthenticated access, meaning that any system exposed to network traffic could be compromised if the specific versions are deployed. Successful exploitation would give an attacker complete system control, enabling data exfiltration, service disruption, or further lateral movement.