Dell PowerProtect Data Domain versions 8.5 through 8.6 contain a command injection flaw that allows a high‑privileged attacker with remote access to run arbitrary commands as root. The vulnerability stems from unsanitized input being included in a shell command, which can be exploited to execute any code the attacker wishes, compromising confidentiality, integrity, and availability of the affected system.

Dell PowerProtect Data Domain versions 8.5 and 8.6, including all minor releases derived from those code bases.

The CVSS score of 6.7 indicates a moderate‑to‑high severity. The EPSS score of 0.01159% suggests a low but non‑negligible likelihood of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector requires a high‑privileged network user with remote access; from that position an attacker can submit crafted requests that trigger the command injection and obtain root privileges.