Description
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization
of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
Published: 2026-04-17
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary Command Execution with Root Privileges
Action: Immediate Patch
AI Analysis

Impact

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

Affected Systems

The vulnerable versions are Dell PowerProtect Data Domain 7.7.1.0 through 8.7.0.0, LTS2025 releases 8.3.1.0 through 8.3.1.20, and LTS2024 releases 7.13.1.0 through 7.13.1.60. Any appliance running these builds is susceptible until updated to a patched release.

Risk and Exploitability

The CVSS score of 6.7 indicates moderate severity, and the EPSS score of 0.00624 shows a very low exploitation probability. The vulnerability requires local, highly privileged access, which further limits its likelihood. The issue is not listed in the CISA KEV catalog. Because the attack needs local control, the risk is confined to environments where administrative credentials or physical access can be compromised, though a successful exploit would grant full system compromise.

Generated by OpenCVE AI on October 17, 2026 at 10:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Dell PowerProtect Data Domain security update DSA‑2026‑060 to upgrade to a version that fixes the command injection flaw.
  • Reduce the number of local accounts with administrative rights and enforce the principle of least privilege.
  • Physically secure the appliance and restrict physical access to prevent local attackers from gaining elevated privileges.
  • Enable and monitor audit logs for unexpected command execution or use of privileged shells, and investigate any anomalies promptly.

Generated by OpenCVE AI on October 17, 2026 at 10:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 11:00:00 +0000

Type Values Removed Values Added
Title Local Privileged OS Command Injection in Dell PowerProtect Data Domain

Wed, 14 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

Wed, 05 Aug 2026 04:00:00 +0000

Type Values Removed Values Added
Title Local Privileged OS Command Injection in Dell PowerProtect Data Domain

Tue, 04 Aug 2026 08:30:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

Fri, 08 May 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Dell data Domain Operating System
Dell powerprotect Dp Series Appliance
CPEs cpe:2.3:a:dell:powerprotect_dp_series_appliance:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:*
cpe:2.3:o:dell:data_domain_operating_system:8.7.0.0:*:*:*:*:*:*:*
Vendors & Products Dell data Domain Operating System
Dell powerprotect Dp Series Appliance

Sat, 18 Apr 2026 03:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 17 Apr 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Domain
Vendors & Products Dell
Dell powerprotect Data Domain

Fri, 17 Apr 2026 11:15:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Dell Data Domain Operating System Powerprotect Data Domain Powerprotect Dp Series Appliance
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-10-14T14:13:16.140Z

Reserved: 2026-04-01T05:04:41.955Z

Link: CVE-2026-35074

cve-icon Vulnrichment

Updated: 2026-04-18T02:56:15.329Z

cve-icon NVD

Status : Modified

Published: 2026-04-17T11:16:10.737

Modified: 2026-10-26T22:10:00.163

Link: CVE-2026-35074

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T10:45:07Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')