CVE-2026-46738 is an improper input validation vulnerability affecting Dell PowerProtect Data Manager versions before 20.2.0.0. The flaw exists in the REST API and allows a high privileged remote attacker to potentially elevate their privileges. The vulnerability has a critical severity rating with a CVSS 3.1 vector indicating network attack vector, low attack complexity, high privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability. No explicit patch or remediation details are provided in the source data.

Successful exploitation could lead to elevation of privileges by a high privileged remote attacker, potentially compromising confidentiality, integrity, and availability of the affected system. This could allow the attacker to perform unauthorized actions beyond their original privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote access to the REST API to trusted users only and monitor for suspicious activity involving high privileged accounts.