Dell PowerProtect Data Domain versions 8.5 through 8.6 contain a command injection flaw that allows a high‑privileged attacker with remote access to run arbitrary commands as root. The vulnerability stems from unsanitized input being included in a shell command, which can be exploited to execute any code the attacker wishes, compromising confidentiality, integrity, and availability of the affected system.

Dell PowerProtect Data Domain, affected directly by versions 8.5, 8.5.1, 8.6, and any minor revisions released with the same code base.

The CVSS score of 6.7 indicates a moderate‑to‑high severity. EPSS information is not available, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector involves a remote attacker who already has privileged network access to the PowerProtect appliance; from that position an attacker can submit crafted requests that trigger the command injection and obtain root privileges.