Description
Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an
improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with
root privileges.
Published: 2026-04-17
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, as well as the LTS2025 release versions 8.3.1.0 through 8.3.1.20 and LTS2024 release versions 7.13.1.0 through 7.13.1.60, contain an improper neutralization of special elements in the OS command processing. A high‑privileged attacker who has local access could exploit this flaw to inject arbitrary commands and achieve root‑level execution.

Affected Systems

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 are impacted.

Risk and Exploitability

The CVSS score of 6.7 indicates a medium severity vulnerability, and the EPSS score of 0.00571 (< 1%) shows a very low likelihood of exploitation. Because the flaw requires local high‑privileged access, the attack vector is inferred to be local. The vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation to date. Nonetheless, the potential for root‑level command execution warrants prompt attention.

Generated by OpenCVE AI on August 5, 2026 at 03:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Dell PowerProtect Data Domain DSA‑2026‑060 security update from Dell support.
  • Upgrade to a patched firmware version that falls outside the affected version ranges.
  • Restart or reboot the affected services to ensure the patch is active and verify that no local accounts retain unnecessary elevated privileges.

Generated by OpenCVE AI on August 5, 2026 at 03:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Tue, 04 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

Fri, 08 May 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Dell data Domain Operating System
CPEs cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:data_domain_operating_system:8.7.0.0:*:*:*:*:*:*:*
Vendors & Products Dell data Domain Operating System

Sat, 18 Apr 2026 09:45:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Fri, 17 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Domain
Vendors & Products Dell
Dell powerprotect Data Domain

Fri, 17 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 17 Apr 2026 11:15:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Dell Data Domain Operating System Powerprotect Data Domain
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-08-04T08:14:54.500Z

Reserved: 2026-04-01T05:04:41.955Z

Link: CVE-2026-35073

cve-icon Vulnrichment

Updated: 2026-04-17T11:26:38.363Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-17T11:16:10.610

Modified: 2026-06-17T10:40:03.850

Link: CVE-2026-35073

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T03:45:03Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')