EUVD-2026-23879
GHSA-gxrh-c9qf-pf88
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.40, contain an OS command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.
AnalysisAI
OS command injection in Dell PowerProtect Data Domain allows remote high-privileged attackers to execute arbitrary commands on DD OS versions 7.7.1.0-8.5, LTS2025 8.3.1.0-8.3.1.10, and LTS2024 7.13.1.0-7.13.1.40. Dell published DSA-2026-060 addressing this CWE-78 flaw with CVSS 7.2 (high impact on confidentiality, integrity, availability). …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all Dell PowerProtect Data Domain deployments and document current OS versions (check DSA-2026-060 affected ranges: 7.7.1.0-8.5, LTS2025 8.3.1.0-8.3.1.10, LTS2024 7.13.1.0-7.13.1.40); restrict administrative access to Data Domain systems to essential personnel only and require multi-factor authentication for privileged accounts. Within 7 days: Isolate affected Data Domain instances from non-essential network access and implement network segmentation if systems are internet-facing; monitor administrative account activity for unauthorized command execution. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today