Description
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special Elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.
Published: 2026-07-03
Score: 6.5 Medium
EPSS: 1.1% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This vulnerability arises from an improper neutralization of special elements used in an OS command, allowing an attacker with high privileges and remote access to inject arbitrary commands for command execution on the target system.

Affected Systems

Dell PowerProtect Data Domain is affected. through 8.7 inclusive, LTS2026 release versions 8.6.1.0 through 8.6.1.10, LTS2025 release versions 8.3.1.0 through 8.3.1.30, and LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain the flaw.

Risk and Exploitability

The CVSS score of 6.5. EPSS score of 1% reflects a low‑to‑moderate probability of exploitation. This vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires a high‑privileged attacker with remote access to the data domain’s management interface to inject OS commands, which can lead to full system compromise.

Generated by OpenCVE AI on July 21, 2026 at 09:56 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Dell security update referenced in the Dell Support documentation to upgrade PowerProtect Data Domain to a non‑vulnerable version.
  • Restrict remote privileged access to the data domain’s management interface using firewall rules or network segmentation to reduce the attack surface.
  • Implement input sanitization or escape mechanisms for any user‑supplied data that is used in OS command construction, following CWE‑78 mitigation guidelines.
  • Monitor system logs for unexpected command execution and configure alerts for anomalous activity that may indicate exploitation attempts.

Generated by OpenCVE AI on July 21, 2026 at 09:56 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 17 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection via Improper Neutralization in Dell PowerProtect Data Domain

Wed, 15 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
Title OS Command Injection via Improper Neutralization in Dell PowerProtect Data Domain

Mon, 13 Jul 2026 03:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection via Improper Neutralization of Special Elements in Dell PowerProtect Data Domain

Sat, 11 Jul 2026 23:45:00 +0000

Type Values Removed Values Added
Title OS Command Injection via Improper Neutralization of Special Elements in Dell PowerProtect Data Domain

Sat, 11 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Title Improper Neutralization of Special Elements Used in OS Command Leading to Command Execution in Dell PowerProtect Data Domain

Thu, 09 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Title Improper Neutralization of Special Elements Used in OS Command Leading to Command Execution in Dell PowerProtect Data Domain

Thu, 09 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title Remote OS Command Injection in Dell PowerProtect Data Domain

Wed, 08 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Title Remote OS Command Injection in Dell PowerProtect Data Domain

Tue, 07 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Allowing Remote Command Execution

Mon, 06 Jul 2026 19:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Allowing Remote Command Execution

Mon, 06 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Mon, 06 Jul 2026 01:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Sun, 05 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title Improper OS Command Injection in Dell PowerProtect Data Domain

Sun, 05 Jul 2026 09:00:00 +0000

Type Values Removed Values Added
Title Improper OS Command Injection in Dell PowerProtect Data Domain

Sat, 04 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection via Improper Neutralization in Dell PowerProtect Data Domain

Sat, 04 Jul 2026 12:45:00 +0000

Type Values Removed Values Added
Title OS Command Injection via Improper Neutralization in Dell PowerProtect Data Domain

Sat, 04 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Enabling Remote Privileged Command Execution

Fri, 03 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Enabling Remote Privileged Command Execution

Fri, 03 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Domain
Vendors & Products Dell
Dell powerprotect Data Domain

Fri, 03 Jul 2026 13:15:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special Elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H'}

Subscriptions

Dell Powerprotect Data Domain
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-07-07T03:56:14.341Z

Reserved: 2026-02-13T18:05:27.825Z

Link: CVE-2026-26355

cve-icon Vulnrichment

Updated: 2026-07-06T15:29:24.256Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T10:00:04Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')