Description
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
Published: 2026-07-03
Score: 6.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is an improper neutralization of special elements used in an OS command, classified as CWE‑78. It allows a high‑privileged attacker with local access to inject and run arbitrary commands on Dell PowerProtect Data Domain appliances, potentially compromising system integrity and data confidentiality.

Affected Systems

Dell PowerProtect Data Domain appliances with versions 7.7.1.0 through 8.6, LTS2026 series 8.6.1.0 through 8.6.1.10, LTS2025 series 8.3.1.0 through 8.3.1.30, and LTS2024 series 7.13.1.0 through 7.13.1.70 are affected.

Risk and Exploitability

The CVSS score of 6.7 indicates medium severity, while the EPSS score of less than 1% suggests a very low likelihood of exploitation at this time. The flaw is not listed in the CISA KEV catalog, implying no currently widespread exploits. However, the requirement for high‑ arbitrary commands, potentially leading to full system compromise or data exfiltration.

Generated by OpenCVE AI on July 22, 2026 at 13:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Dell PowerProtect Data Domain security update released in DSA‑2026‑278 for the affected release series.
  • Restrict privileged local access to essential administrators and disable unused privileged accounts.
  • Enable audit logging for elevated command execution and monitor for suspicious activity.

Generated by OpenCVE AI on July 22, 2026 at 13:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Jul 2026 13:45:00 +0000

Type Values Removed Values Added
Title Improper OS Command Injection in Dell PowerProtect Data Domain

Fri, 17 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Improper OS Command Injection in Dell PowerProtect Data Domain

Thu, 16 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Improper OS Command Neutralization Leads to Command Execution in Dell PowerProtect Data Domain

Tue, 14 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Improper OS Command Neutralization Leads to Command Execution in Dell PowerProtect Data Domain

Mon, 13 Jul 2026 22:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Mon, 13 Jul 2026 03:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Sun, 12 Jul 2026 09:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain

Sat, 11 Jul 2026 01:45:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain

Fri, 10 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Thu, 09 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Wed, 08 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 08 Jul 2026 07:00:00 +0000

Type Values Removed Values Added
Title OS Command Injection with Local Privilege in Dell PowerProtect Data Domain

Tue, 07 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection with Local Privilege in Dell PowerProtect Data Domain

Mon, 06 Jul 2026 22:15:00 +0000

Type Values Removed Values Added
Title Local High-Privileged OS Command Injection in Dell PowerProtect Data Domain

Mon, 06 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
Title Local High-Privileged OS Command Injection in Dell PowerProtect Data Domain

Mon, 06 Jul 2026 04:45:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Sun, 05 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Title OS Command Injection Vulnerability in Dell PowerProtect Data Domain

Sun, 05 Jul 2026 12:30:00 +0000

Type Values Removed Values Added
Title OS Command Injection via Improper Neutralization on Dell PowerProtect Data Domain

Sun, 05 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Title OS Command Injection via Improper Neutralization on Dell PowerProtect Data Domain

Sat, 04 Jul 2026 17:15:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain OS Command Injection

Sat, 04 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
Title Dell PowerProtect Data Domain OS Command Injection

Sat, 04 Jul 2026 05:15:00 +0000

Type Values Removed Values Added
Title Local OS Command Injection in Dell PowerProtect Data Domain

Fri, 03 Jul 2026 21:00:00 +0000

Type Values Removed Values Added
Title Local OS Command Injection in Dell PowerProtect Data Domain

Fri, 03 Jul 2026 16:00:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Domain
Vendors & Products Dell
Dell powerprotect Data Domain

Fri, 03 Jul 2026 13:15:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 6.7, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Dell Powerprotect Data Domain
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-07-07T13:12:01.597Z

Reserved: 2026-06-15T17:49:28.560Z

Link: CVE-2026-54483

cve-icon Vulnrichment

Updated: 2026-07-06T18:13:12.290Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-22T13:30:05Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')