{"id":"CVE-2026-94346","kind":"vulnerability","aliases":["CVE-2026-94346"],"related":[],"title":"Dell PowerProtect Data Domain Virtual Edition: path traversal allows command execution","description":"PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Path Traversal vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.","summary":"PowerProtect Data Domain Virtual Edition contains a path traversal flaw across several feature and LTS release lines. A high-privileged attacker with remote access could exploit it to execute commands.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","data-domain","dell","powerprotect","vendor"],"not_affected_if":["no-remote-admin-access","version-outside-range"],"how_to_check":"- Check the installed Data Domain Virtual Edition release version against the affected ranges in the NVD entry (for example, `7.13.1.0` through `7.13.1.70` on LTS2024, `8.3.1.0` through `8.3.1.30` on LTS2025, `8.6.1.0` through `8.6.1.10` on LTS2026).","fix":"- Move Data Domain Virtual Edition to a fixed release listed in the vendor advisory; the sources do not name the fixed versions, so unknown.","status":"open","published_at":"2026-10-27T14:17:05+00:00","first_seen_at":"2026-10-27T14:32:26+00:00","triaged_at":"2026-10-27T14:32:57+00:00","updated_at":"2026-10-27T14:32:57+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-27T14:32:57Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain Virtual Edition to a fixed release listed in the vendor advisory; the sources do not name the fixed versions, so unknown.","reach":"network","title":"Dell PowerProtect Data Domain Virtual Edition: path traversal allows command execution","impact":"high","summary":"PowerProtect Data Domain Virtual Edition contains a path traversal flaw across several feature and LTS release lines. A high-privileged attacker with remote access could exploit it to execute commands.","category":"vendor","nicknames":[],"who_cares":["powerprotect","data-domain","backup","dell"],"confidence":0.6,"needs_auth":"yes","worst_case":"High-privileged remote attacker executes commands on the appliance","analyst_note":"Find the Dell security advisory for CVE-2026-94346 to confirm fixed versions and workarounds; the NVD entry alone does not give them.","how_to_check":"- Check the installed Data Domain Virtual Edition release version against the affected ranges in the NVD entry (for example, `7.13.1.0` through `7.13.1.70` on LTS2024, `8.3.1.0` through `8.3.1.30` on LTS2025, `8.6.1.0` through `8.6.1.10` on LTS2026).","needs_analyst":true,"not_affected_if":["version-outside-range","no-remote-admin-access"],"who_is_affected":"Teams running PowerProtect Data Domain Virtual Edition in the listed release ranges, with remote administrative access to the appliance. The sources say the attacker must already hold high privileges, so exposure depends on who has those accounts. Installations outside the listed ranges are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000646,"input_tokens":3404,"output_tokens":612,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-94346':14A,17A '7.13.1.0':70C '7.13.1.70':72C '7.7.1.0':64C '8.3.1.0':76C '8.3.1.30':78C '8.6.1.0':82C '8.6.1.10':84C '8.7':66C 'access':49B,96C 'across':35B 'allow':9A 'attack':46B,93C 'backup':18B 'command':10A,55B,104C 'contain':30B,85C 'could':50B,97C 'cve':12A,15A 'data':3A,20B,26B,57C 'data-domain':19B 'dell':1A,22B 'domain':4A,21B,27B,58C 'edit':6A,29B,60C 'execut':11A,54B,105C 'exploit':51B,99C 'featur':37B,61C 'flaw':34B 'high':44B,91C 'high-privileg':43B 'lead':102C 'line':41B 'lts':39B 'lts2024':67C 'lts2025':73C 'lts2026':79C 'path':7A,32B,87C 'potenti':98C 'powerprotect':2A,23B,25B,56C 'privileg':45B,92C 'releas':40B,62C,68C,74C,80C 'remot':48B,95C 'sever':36B 'travers':8A,33B,88C 'vendor':24B 'version':63C,69C,75C,81C 'virtual':5A,28B,59C 'vulner':89C,101C","nicknames":[],"mitigations":[],"who_affected":"Teams running PowerProtect Data Domain Virtual Edition in the listed release ranges, with remote administrative access to the appliance. The sources say the attacker must already hold high privileges, so exposure depends on who has those accounts. Installations outside the listed ranges are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94346","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94346","severity":null,"published_at":"2026-10-27T14:17:05+00:00","modified_at":"2026-10-27T14:17:05+00:00","first_seen_at":"2026-10-27T14:32:26+00:00","fetched_at":"2026-10-27T14:32:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}