Description
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.
Published: 2026-07-03
Score: 7.2 High
EPSS: 1.2% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An OS command injection flaw classified as CWE‑78 allows an attacker who can supply high‑privileged input to execute arbitrary operating system commands. The vulnerability is triggered when special elements in input are not properly neutralized, enabling remote command execution with the privileges of the affected process. This can result in full compromise of the data domain appliance, allowing attackers to read, modify, or delete data and disrupt services.

Affected Systems

Dell PowerProtect Data Domain appliances are impacted, covering all product releases from version 7.7.1.0 through 8.7. This includes the LTS2026 releases 8.6.1.0 through 8.6.1.10, LTS2025 releases 8.3.1.0 through 8.3.1.30, and LTS2024 releases 7.13.1.0 through 7.13.1.70.

Risk and Exploitability

The CVSS score of 7.2 indicates high severity, while the EPSS of 1% reflects a very low but non‑zero likelihood of exploitation. The vulnerability is not in the CISA KEV catalog, implying no publicly known exploits at this time. Attack requires remote high‑privilege access, but once achieved it provides attackers with arbitrary command execution and full system compromise.

Generated by OpenCVE AI on July 31, 2026 at 14:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Dell PowerProtect Data Domain security update referenced in Dell DSA‑2026‑278 to patch the OS command injection flaw.
  • Limit remote management interface exposure by restricting access to authorized users and enforcing network segmentation or firewall rules.
  • Enable comprehensive logging for management and command execution services and monitor logs for indicators of injection or unauthorized command use.

Generated by OpenCVE AI on July 31, 2026 at 14:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 31 Jul 2026 15:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Allowing Remote Code Execution

Sun, 26 Jul 2026 23:00:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Allowing Remote Code Execution

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Leading to Remote Code Execution

Tue, 21 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Leading to Remote Code Execution

Fri, 17 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain OS Command Injection Vulnerability

Wed, 15 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain OS Command Injection Vulnerability

Tue, 14 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Enabling Remote Code Execution

Mon, 13 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Enabling Remote Code Execution

Sun, 12 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain OS Command Injection Vulnerability

Sat, 11 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain OS Command Injection Vulnerability

Fri, 10 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Allows Remote Code Execution

Thu, 09 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Allows Remote Code Execution

Thu, 09 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain

Wed, 08 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain

Wed, 08 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain

Tue, 07 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain

Sun, 05 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Sat, 04 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Sat, 04 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Title Improper Neutralization of OS Command Elements Allowing Remote Command Execution in Dell PowerProtect Data Domain

Sat, 04 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Title Improper Neutralization of OS Command Elements Allowing Remote Command Execution in Dell PowerProtect Data Domain

Fri, 03 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Domain
Vendors & Products Dell
Dell powerprotect Data Domain

Fri, 03 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Dell Data Domain Operating System Powerprotect Data Domain
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-07-07T03:56:11.694Z

Reserved: 2026-06-09T17:04:35.249Z

Link: CVE-2026-53478

cve-icon Vulnrichment

Updated: 2026-07-07T02:15:32.824Z

cve-icon NVD

Status : Analyzed

Published: 2026-07-03T15:16:32.840

Modified: 2026-07-08T19:31:54.393

Link: CVE-2026-53478

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T15:00:04Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')