The vulnerability involves improper privilege management in Dell PowerProtect Data Domain, allowing a high‑privileged local attacker to elevate privileges. This flaw is classified as CWE‑269. When exploited, the attacker could gain higher access rights than intended, potentially compromising data integrity and availability. No information is provided about remote exploitation or denial of service.

Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, and LTS2026 release versions 8.6.1.0 through 8.6.1.20 are affected.

The CVSS score of 6.3 indicates moderate severity. EPSS data is not available, but the vulnerability requires the attacker to have local high‑privilege access, implying that the exploitation probability is limited to trusted users or compromised local accounts. The issue is not listed in CISA KEV, suggesting no known large‑scale exploitation yet. Therefore, the risk is significant for environments where local administrators are accessible and can be exploited for privilege escalation.