Cyber Resilience

CVE-2026-46465

Dell Data Domain Operating System 7.7.1.0 – 7.13.1.70

Published
03 July 2026
Modified
08 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
EPSS Score 0.0024 15th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-46465 is a medium-severity Use of Externally-Controlled Format String (CWE-134) vulnerability in Dell Data Domain Operating System. Its CVSS base score is 5.5 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of externally-controlled format string vulnerability. A high privileged attacker with remote…

more

access could potentially exploit this vulnerability, leading to Information disclosure and denial of service.

CWE(s)
CWE-134

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

Remote exploitation of format string flaw on public-facing appliance enables initial access (T1190); direct impact includes application/system DoS via crafted input (T1499.004). Info disclosure does not map to a specific credential or data-staging technique without further assumptions.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-53482Same product: Dell Data Domain Operating System
CVE-2026-46463Same product: Dell Data Domain Operating System
CVE-2026-53481Same product: Dell Data Domain Operating System
CVE-2025-22475Same product: Dell Data Domain Operating System
CVE-2026-56086Same product: Dell Data Domain Operating System
CVE-2026-26355Same product: Dell Data Domain Operating System
CVE-2026-41123Same product: Dell Data Domain Operating System
CVE-2026-49815Same product: Dell Data Domain Operating System
CVE-2026-53483Same product: Dell Data Domain Operating System
CVE-2025-46645Same product: Dell Data Domain Operating System

Affected Assets

dell
data domain operating system
7.7.1.0 — 7.13.1.70 · 8.0.0.0 — 8.3.1.30 · 8.4.0.0 — 8.7.0.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • AC-6 Least Privilege
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly blocks externally-controlled format strings by validating all remote input before use in formatting functions.

AC-6 Least Privilege partial match
prevent

Limits the blast radius of a high-privileged remote attacker who could otherwise trigger the format-string flaw.

SI-2 Flaw Remediation partial match
prevent

Requires timely patching of the Dell PowerProtect format-string vulnerability in the listed versions.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent external format strings via code review, static analysis, and safe APIs.

ID.RA-01 partial match
prevents

Vulnerability identification can discover existing format-string flaws but does not prevent their introduction.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing in development can detect format-string vulnerabilities before release.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC mandates input validation and safe API usage that can prevent externally-controlled format strings.

A.8.26 Application security requirements partial match
prevents

Application security requirements can specify safe formatting functions and ban uncontrolled format strings.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles discourage dangerous string-handling patterns that lead to format-string issues.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly forbid the use of untrusted format strings and prescribe safe alternatives.

References