Description
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.
Published: 2026-07-03
Score: 7.2 High
EPSS: 1.2% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an OS command injection, classified as CWE‑78. An attacker with high‑priv crafted input that is executed as an operating system command, allowing arbitrary code execution with the privileges of the affected process. This threat can compromise confidentiality control over the host.

Affected Systems

The affected product is Dell PowerProtect Data Domain. Versions 7.7.1.0 through 8.7, LTS2026 release versions 8.6.1.0 through 8.6.1.10, LTS2025 release versions 8.3.1.0 through 8.3.1.30, and LTS2024 release versions 7.13.1.0 through 7.13.1.70 are impacted.

Risk and Exploitability

The CVSS score of 7.2 indicates high severity, and the EPSS score of 1% shows a very low yet nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no publicly disclosed exploits at this time. Exploitation requires remote high‑privilege access, but once achieved it enables arbitrary OS command execution and full system compromise.

Generated by OpenCVE AI on July 21, 2026 at 09:50 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Dell PowerProtect Data Domain security update referenced in Dell DSA‑2026‑278 to patch the OS command injection flaw.
  • Restrict remote management interfaces to authorized users and control exposure through network segmentation or firewall rules.
  • Enable comprehensive logging on management services and monitor logs for anomalous command execution or injection patterns.

Generated by OpenCVE AI on July 21, 2026 at 09:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 21 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Leading to Remote Code Execution

Fri, 17 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain OS Command Injection Vulnerability

Wed, 15 Jul 2026 18:45:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain OS Command Injection Vulnerability

Tue, 14 Jul 2026 10:00:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Enabling Remote Code Execution

Mon, 13 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Enabling Remote Code Execution

Sun, 12 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain OS Command Injection Vulnerability

Sat, 11 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain OS Command Injection Vulnerability

Fri, 10 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Allows Remote Code Execution

Thu, 09 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Allows Remote Code Execution

Thu, 09 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain

Wed, 08 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain

Wed, 08 Jul 2026 00:00:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain

Tue, 07 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain

Sun, 05 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Sat, 04 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Sat, 04 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Title Improper Neutralization of OS Command Elements Allowing Remote Command Execution in Dell PowerProtect Data Domain

Sat, 04 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Title Improper Neutralization of OS Command Elements Allowing Remote Command Execution in Dell PowerProtect Data Domain

Fri, 03 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Domain
Vendors & Products Dell
Dell powerprotect Data Domain

Fri, 03 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Dell Powerprotect Data Domain
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-07-07T03:56:11.694Z

Reserved: 2026-06-09T17:04:35.249Z

Link: CVE-2026-53478

cve-icon Vulnrichment

Updated: 2026-07-07T02:15:32.824Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-21T10:00:04Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')