Description
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.
Published: 2026-10-28
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: Remote Command Execution
Action: Immediate Patch
AI Analysis

Impact

A low‑privileged attacker with remote access can exploit an OS command injection flaw in Dell PowerProtect Data Domain, allowing execution of arbitrary system commands. This results in a full compromise of the affected system, potentially exposing sensitive data, altering configurations, or disrupting service availability.

Affected Systems

Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, and LTS2026 release versions 8.6.1.0 through 8.6.1.20 are vulnerable.

Risk and Exploitability

The flaw scores a CVSS base rating of 8.8, indicating high severity. No EPSS score is available, but the lack of a KEV listing does not diminish the risk posed by the vulnerability. Because the attack can be carried out by a low‑privileged remote user, the potential for exploitation is significant without stringent access controls.

Generated by OpenCVE AI on October 28, 2026 at 10:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Dell security update DSA‑2026‑416 provided for PowerProtect Data Domain to all affected installations.
  • If the update cannot be applied immediately, isolate the device from untrusted networks and restrict remote access to only essential, highly‑trusted administrators.
  • Monitor system logs and process activity for signs of unauthorized command execution, and review audit trails for insider or compromised user activity.

Generated by OpenCVE AI on October 28, 2026 at 10:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title OS Command Injection in Dell PowerProtect Data Domain Allows Remote Command Execution

Wed, 28 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.
Weaknesses CWE-78
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-10-28T09:05:55.474Z

Reserved: 2026-09-07T10:04:28.184Z

Link: CVE-2026-86396

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T09:17:07.540

Modified: 2026-10-28T09:17:07.540

Link: CVE-2026-86396

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T10:30:18Z

Weaknesses
  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')