CVE-2026-94346 in PowerProtect Data Domain Virtual Edition
Summary
by MITRE • 10/27/2026
PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Path Traversal vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The identified security flaw resides within PowerProtect Data Domain Virtual Edition across multiple release tracks including Feature Releases from version 7.7.1.0 through 8.7 and Long Term Support releases spanning LTS2024 versions 7.13.1.0 to 7.13.1.70, LTS2025 versions 8.3.1.0 to 8.3.1.30, and LTS2026 versions 8.6.1.0 to 8.6.1.10. This vulnerability is classified as a Path Traversal issue which fundamentally stems from insufficient validation of user-supplied input when processing file paths or resource identifiers within the application logic. The core technical deficiency lies in the system's failure to properly neutralize special elements such as dot-dot-slash sequences that could be interpreted by the underlying operating system as relative path indicators. By manipulating these inputs, an attacker can direct the application to access files and directories outside of the intended restricted scope, effectively bypassing standard file system security boundaries designed to isolate application data from critical system resources.
The operational impact of this vulnerability is severe due to the specific privilege requirements for exploitation. A high privileged attacker with remote access capabilities can leverage this path traversal flaw to read sensitive configuration files, extract cryptographic keys, or access proprietary backup metadata that should remain inaccessible. More critically, if the vulnerable component interacts with functions capable of executing system commands based on file paths or content derived from these traversed locations, the vulnerability escalates directly into Remote Code Execution. This means an authenticated attacker operating at a high privilege level can potentially execute arbitrary code within the context of the application process, gaining full control over the virtual appliance's underlying infrastructure and compromising the integrity, confidentiality, and availability of all stored data protection assets managed by that instance.
From a classification perspective, this vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory which describes how software does not properly restrict pathnames or file names used in operations on files to valid external resources. Furthermore, the exploitation vector and resulting impact map closely to MITRE ATT&CK techniques involving Command and Scripting Interpreter execution via T1059 where an attacker executes commands through system APIs after gaining initial access through privilege escalation facilitated by the traversal flaw. The combination of path manipulation leading to command execution represents a critical failure in input validation and security boundary enforcement within the data domain management interface or associated backend services handling file operations.
Mitigation strategies must prioritize immediate patching as provided by the vendor for all affected version ranges listed above. Organizations should verify their current deployment versions against the specified safe baselines and apply the latest cumulative updates to close this specific code path vulnerability. In environments where immediate patching is not feasible, network segmentation controls should be reviewed to ensure that management interfaces are strictly accessible only from trusted administrative networks with strong authentication mechanisms in place. Additionally, implementing strict input validation policies at the application layer for all file system operations and employing web application firewalls configured to detect common path traversal patterns can provide a temporary defensive layer while permanent remediation is executed. Regular auditing of access logs for unusual file read attempts or privilege escalation events will also aid in early detection of any attempted exploitation activities targeting this weakness.