PowerProtect Data Domain CVE-2026-110541

Exploitation requires the attacker to already hold high administrative privileges on the Dell PowerProtect Data Domain appliance (CVSS PR:H); it is not reachable by an unauthenticated or low-privileged remote user. Given that prerequisite, the attack is network-based with low complexity and no user interaction (AV:N/AC:L/UI:N). The available advisory does not name the exact affected management feature, command, or parameter that accepts the unneutralized input, so the precise trigger is not described in the available sources. The primary limiting factor is the prior-privilege requirement; affected trains are Feature Release 7.7.1.0-8.8, LTS2024 7.13.1.0-7.13.1.80, LTS2025 8.3.1.0-8.3.1.40, and LTS2026 8.6.1.0-8.6.1.20.

This is a genuine but conditional-risk issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, base 7.2 HIGH) shows the flaw is reachable over the network with low attack complexity and no user interaction, but it explicitly requires PR:H - a high-privileged, authenticated attacker. That single factor is the dominant limiter: an actor must already hold administrative/high-privilege access to the appliance before command execution (C:H/I:H/A:H, full compromise of the host) becomes possible. The vuln.today decision label is 'this_week', consistent with a patched, authenticated-admin flaw on an enterprise appliance rather than act_now/emergency. There is no CISA KEV listing and no EPSS score provided, and no public exploit or PoC reference is present in the input - so there is no signal of active exploitation or widespread weaponization. The signals are internally consistent (no conflict between the network vector and the description, both of which describe remote-but-privileged command injection); the main caveat is simply that the PR:H gate means real-world risk hinges on prior admin compromise, insider misuse, or credential theft rather than anonymous internet exploitation.

An attacker who has already obtained high-privileged administrative access to a Dell PowerProtect Data Domain appliance (for example via stolen admin credentials or an insider) sends crafted input to an affected management function that fails to neutralize OS special characters, injecting attacker-controlled commands that run on the underlying system. This yields full command execution on the backup appliance, compromising the confidentiality, integrity, and availability of backup data. No public exploit code or PoC reference is identified in the available data.