CVE-2026-46737 describes an improper input validation vulnerability (CWE-20) in Dell PowerProtect Data Manager's REST API. Versions before 20.2.0.0 are affected. A remote attacker with high privileges could exploit this vulnerability to achieve remote code execution. The CVSS vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and high availability impact. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could lead to remote code execution by a high-privileged attacker, potentially compromising confidentiality and availability of the affected system. Integrity impact is low. The vulnerability affects the REST API component, which may be accessible remotely, increasing risk if high-privileged credentials are compromised or misused.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the REST API to trusted users only and monitor for suspicious activity involving high-privileged accounts. Follow Dell's official communications for updates on patches or mitigations.