What is the CVSS score of CVE-2026-22277?

CVE-2026-22277 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Unity Operating Environment are affected by CVE-2026-22277?

Dell UnityVSA storage systems running version 5.4 and earlier are vulnerable to OS command injection attacks that could allow unauthorized attackers to execute arbitrary commands with system-level…

How to fix or mitigate CVE-2026-22277?

Within 24 hours: Inventory all Dell UnityVSA deployments and document versions; restrict network access to UnityVSA management interfaces to authorized personnel only via firewall rules; disable remote management protocols if not actively required. Within 7 days: Implement enhanced monitoring and logging on affected systems for suspicious command execution; review access logs for any unauthorized activities; contact Dell support for guidance on available workarounds. Within 30 days: Develop and execute migration plan to upgrade UnityVSA to version 5.5 or later once patch availability is confirmed; establish timeline for remediation with business units dependent on affected storage systems.

Unity Operating Environment CVE-2026-22277

HIGH

OS Command Injection (CWE-78)

2026-01-30 security_alert@emc.com

Command Injection Unity Operating Environment

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

CVE Published

Jan 30, 2026 - 09:15 nvd

HIGH 7.8

DescriptionCVE.org

Dell UnityVSA, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

AnalysisAI

Dell UnityVSA versions 5.4 and prior allow local attackers with low privileges to achieve arbitrary command execution with root-level access through OS command injection. This vulnerability requires local access and no user interaction, enabling attackers to completely compromise affected systems. No patch is currently available.

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects Unity Operating Environment. Dell UnityVSA, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.