Dell PowerProtect Data Domain includes an Improper Privilege Management flaw that allows a remote attacker with high privileged access to elevate their privileges. This weakness enables the attacker to gain additional rights, potentially compromising confidentiality, integrity, and availability of the data domain system. The vulnerability is classified as CWE-269, an authority failure that permits unauthorized privilege escalation.

Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, and LTS2026 release versions 8.6.1.0 through 8.6.1.20 are impacted. All installations of these releases are susceptible to the privilege escalation flaw.

The CVSS score of 6.7 indicates a moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower likelihood of widespread exploitation at this time. However, a remote attacker who can gain a high‑privileged context can leverage the flaw to elevate privileges and gain further access. The likely attack vector is remote access with elevated privileges, making containment dependent on enforcing least privilege and applying vendor patches promptly.