Description
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization
of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
Published: 2026-04-17
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Command execution with root privileges
Action: Patch
AI Analysis

Impact

Dell PowerProtect Data Domain devices are affected by a vulnerability that permits a local user with high‑privileged access to circumvent proper input sanitization, resulting in an OS command injection that can execute arbitrary commands with root privileges.

Affected Systems

The flaw applies to Data Domain firmware versions 7.7.1.0 through 8.6.0.0 and 8.7.0.0, the LTS2025 releases 8.3.1.0 through 8.3.1.20, and the LTS2024 releases 7.13.1.0 through 7.13.1.60.

Risk and Exploitability

The CVSS score of 6.7 signals medium severity, while the EPSS score of <1% indicates a very low likelihood of exploitation. Because the vulnerability requires local, high‑privileged access, the attack vector is local. The issue is not listed in CISA’s KEV catalogue, implying no widespread public exploitation yet, yet the ability to obtain root‑level command execution warrants immediate action.

Generated by OpenCVE AI on October 17, 2026 at 12:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Download and install the Dell DSA‑2026‑060 security update for PowerProtect Data Domain from Dell support.
  • Upgrade the device firmware to a version outside the affected ranges, such as 8.8.0.0 or later.
  • Restart or reboot the PowerProtect Data Domain services to finalize the update.

Generated by OpenCVE AI on October 17, 2026 at 12:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Firmware

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

Wed, 05 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Tue, 04 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

Fri, 08 May 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Dell data Domain Operating System
CPEs cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:data_domain_operating_system:8.7.0.0:*:*:*:*:*:*:*
Vendors & Products Dell data Domain Operating System

Sat, 18 Apr 2026 09:45:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Fri, 17 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Domain
Vendors & Products Dell
Dell powerprotect Data Domain

Fri, 17 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 17 Apr 2026 11:15:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Dell Data Domain Operating System Powerprotect Data Domain
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-10-14T14:14:07.944Z

Reserved: 2026-04-01T05:04:41.955Z

Link: CVE-2026-35073

cve-icon Vulnrichment

Updated: 2026-04-17T11:26:38.363Z

cve-icon NVD

Status : Modified

Published: 2026-04-17T11:16:10.610

Modified: 2026-10-26T22:10:00.163

Link: CVE-2026-35073

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T12:15:08Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')