Description
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an OS command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
Published: 2026-04-20
Score: 7.2 High
EPSS: n/a
KEV: No
Impact: Remote Command Execution
Action: Apply Patch
AI Analysis

Impact

An operating system command injection flaw exists in Dell PowerProtect Data Domain that allows a high privileged attacker who can reach the system remotely to execute arbitrary commands with root privileges. The vulnerability is a classic OS command injection (CWE‑78) that can lead to total system compromise, including modification of stored data, installation of malware, or disruption of services.

Affected Systems

Dell PowerProtect Data Domain products are affected. The vulnerability spans versions 7.7.1.0 through 8.6, the LTS2025 releases 8.3.1.0 through 8.3.1.20, and the LTS2024 releases 7.13.1.0 through 7.13.1.60.

Risk and Exploitability

The CVSS score of 7.2 indicates a high severity of remote exploitation. EPSS information is not provided, and the vulnerability is not listed in CISA KEV at this time, suggesting a lower likelihood of widespread exploitation externally. However, because the flaw requires high privilege and remote access, it poses a significant risk if an attacker can gain remote connectivity to the protected domain.

Generated by OpenCVE AI on April 20, 2026 at 17:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Dell PowerProtect Data Domain security update available from Dell’s support site.
  • Restrict remote management access to trusted IP addresses or enforce network segmentation to limit potential attack surface.
  • Configure auditing and monitoring for unexpected command execution and regularly review system logs for signs of compromise.

Generated by OpenCVE AI on April 20, 2026 at 17:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 21 Apr 2026 02:15:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Domain
Vendors & Products Dell
Dell powerprotect Data Domain

Mon, 20 Apr 2026 17:45:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Allows Root Privilege Escalation

Mon, 20 Apr 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 20 Apr 2026 16:45:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an OS command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Dell Powerprotect Data Domain
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-04-20T16:55:16.949Z

Reserved: 2026-02-16T18:04:20.508Z

Link: CVE-2026-26943

cve-icon Vulnrichment

Updated: 2026-04-20T16:43:54.243Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-04-20T17:16:32.793

Modified: 2026-04-20T19:05:30.750

Link: CVE-2026-26943

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-21T02:00:11Z

Weaknesses