CVE-2025-46605 is a session fixation vulnerability affecting Dell PowerProtect Data Domain appliances running DD OS Feature Release versions 8.4 through 8.5. The vulnerability allows a high privileged remote attacker to fixate a session identifier, potentially leading to unauthorized access to the system. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, unchanged scope, with high confidentiality and integrity impact and low availability impact. No vendor advisory or patch information is currently available, and no known exploits have been reported.

Successful exploitation could result in unauthorized access by a high privileged attacker, compromising confidentiality and integrity of the affected system. Availability impact is low. The vulnerability could allow an attacker to hijack or fixate a session, potentially bypassing normal authentication controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor for updates from Dell and apply any recommended mitigations. Given the high privileges required and attack complexity, limiting remote access to trusted administrators may reduce exposure.