Dell PowerProtect Data Domain versions 8.5 and 8.6 suffer from an improper input validation flaw that can allow an attacker with high privileges and remote access to execute arbitrary commands with root privileges. The vulnerability is a classic input validation failure, identified as CWE‑20, and carries a CVSS score of 7.2, indicating a high severity level for potential impact on confidentiality, integrity, and availability.

Affected systems are Dell PowerProtect Data Domain appliances running firmware versions 8.5 or 8.6. No other versions or models are mentioned in the advisory.

The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the CVSS rating signals a high exploitation risk. Based on the advisory, the attack vector requires remote privileged access; once an attacker gains such access, arbitrary command execution can be performed, leading to system compromise.