The vulnerability is a command injection flaw that can be triggered after the attacker obtains high privileged remote access to the Dell PowerProtect Data Domain Management Center. An attacker may execute arbitrary operating‑system commands, which can lead to full system compromise, data exfiltration, or denial of service.

Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, LTS2024 release 7.13.1.0 to 7.13.1.80, LTS2025 release 8.3.1.0 to 8.3.1.40, and LTS2026 release 8.6.1.0 to 8.6.1.20 are affected.

The CVSS score of 7.2 indicates a high risk to confidentiality, integrity and availability. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, which suggests a lower but still present likelihood of exploitation. The vulnerability requires an attacker to have high privileged remote access; therefore, it is unlikely to be exploited over the internet without prior compromise, but once present it can be leveraged for critical damage.