The vulnerability is an Improper Access Control flaw that allows an unauthenticated attacker with remote access to trigger a denial of service condition in Dell PowerProtect Data Domain. The flaw may cause the system to become unreachable or become unresponsive, potentially disrupting backup and recovery operations for affected users.

Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, and LTS2026 release versions 8.6.1.0 through 8.6.1.20 are affected. Users running any of these firmware or software builds are at risk if the vulnerability remains unpatched.

The CVSS score of 6.5 indicates a moderate overall severity. EPSS data is not available, so the current exploit probability cannot be quantified, but the fact that an unauthenticated remote attacker can trigger a denial of service means that exploitation is possible without privileged credentials. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation yet, but the risk to availability and backup workflows warrants prompt remediation. The likely attack vector is a remote connection to the management interface, and no temporary workaround is indicated in the public data.