Data Domain Operating System CVE-2026-23774

Requires high-privileged (administrator-level) access to Dell PowerProtect Data Domain management interfaces. Specifically targets authenticated sessions with administrative rights to DD OS configuration functions that process user input without proper command sanitization. The network attack vector means exploitation occurs remotely over management network connections (typically HTTPS/SSH), not requiring physical appliance access or console connectivity. Exploitation is NOT possible by low-privileged users, unauthenticated attackers, or users with read-only backup operator roles. The vulnerability affects default DD OS configurations across all documented release tracks without requiring non-standard feature enablement. Attack success does not depend on user interaction (UI:N), race conditions, or specialized target environment knowledge (AC:L). Primary limiting factor is the PR:H requirement - attacker must first obtain admin credentials through separate attack vector (credential theft, social engineering, insider access) before exploiting this command injection flaw.

Real-world risk is moderate-high despite the 7.2 CVSS score. The CVSS vector reveals critical contextual factors: network attack vector (AV:N) means remote exploitation without physical access, low complexity (AC:L) indicates reliable exploitation, but high privileges required (PR:H) substantially limits attacker population to those who have already compromised administrator credentials through phishing, credential theft, or insider threat. No public exploit identified at time of analysis and no CISA KEV listing suggest this is not yet widely exploited in the wild. However, Dell PowerProtect Data Domain systems are high-value targets in ransomware kill chains - attackers increasingly target backup infrastructure to prevent recovery. The unchanged scope (S:U) means impact is contained to the Data Domain appliance itself, but given its role as backup repository, full CIA impact (C:H/I:H/A:H) translates to potential backup data theft, tampering with backup integrity to enable undetected ransomware deployment, or destruction of recovery points. Primary risk factors: backup infrastructure criticality, network accessibility, complete post-authentication control. Mitigating factors: requires pre-existing high-privilege access, vendor patch available per DSA-2026-060, no evidence of active exploitation. Organizations using Data Domain in zero-trust segments with strict privileged access management face lower practical risk than those with flat networks or weak admin credential controls.

An attacker who has compromised high-privileged Data Domain administrator credentials (via phishing, credential stuffing, or lateral movement from adjacent systems) connects remotely to the DD OS management interface. They inject shell metacharacters into a vulnerable DD OS management command parameter, such as a backup policy configuration field or system maintenance function. The DD OS processes the crafted input without proper sanitization, executing the attacker's arbitrary commands with system-level privileges. The attacker establishes persistence through backdoor accounts, exfiltrates backup metadata to map enterprise data stores, or deploys ransomware payloads while simultaneously corrupting backup snapshots to prevent recovery.