CVE-2026-46737 is an improper input validation vulnerability (CWE-20) in Dell PowerProtect Data Manager's REST API affecting versions before 20.2.0.0. The vulnerability allows a high privileged remote attacker to potentially achieve remote code execution. The CVSS 3.1 base score is 6.7, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and high availability impact. No vendor advisory or patch information is currently available, and no known exploits are reported in the wild.

An attacker with high privileges and remote access could exploit this vulnerability to execute code remotely, potentially compromising confidentiality and availability of the affected system. Integrity impact is rated low. The vulnerability could lead to significant disruption or unauthorized control of the system if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote access to the REST API to trusted users only and monitor for suspicious activity involving high privileged accounts. Follow Dell's advisories for updates on patches or mitigations.