CVE-2026-46737 is an improper input validation vulnerability in the REST API of Dell PowerProtect Data Manager. Versions before 20.2.0.0 are affected. An attacker with high privileges and remote access could exploit this vulnerability to execute code remotely. The vulnerability stems from insufficient validation of inputs, which may allow malicious data to be processed in an unsafe manner. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and high availability impact.

Successful exploitation could lead to remote code execution by a high privileged attacker, potentially compromising confidentiality and availability of the affected system. Integrity impact is low. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Dell's advisories for updates. Until a fix is available, restrict remote access to the REST API to trusted administrators only and apply network-level controls to limit exposure.