What is the CVSS score of CVE-2026-23778?

CVE-2026-23778 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dell are affected by CVE-2026-23778?

CVE-2026-23778 is a command injection vulnerability in Dell PowerProtect Data Domain that permits high-privileged administrators to escalate to root access, affecting versions 7.7.1.0 through 8.5 and…. A patch is available.

How to fix or mitigate CVE-2026-23778?

24 hours: Inventory all Dell PowerProtect Data Domain deployments and identify instances running affected versions (7.7.1.0-8.5, 7.13.1.0-7.13.1.50, 8.3.1.0-8.3.1.20); document each instance location and current admin access controls. 7 days: Implement administrative access restrictions-limit active administrator accounts to essential personnel only, enforce multi-factor authentication where supported, and enable detailed audit logging of all administrative actions per Dell advisory DSA-2026-060 baseline requirements. 30 days: Contact Dell for patch availability timeline and upgrade planning; prioritize patching production Data Domain appliances to versions incorporating the DSA-2026-060 fix, performing staged upgrades in non-production environments first.

Dell CVE-2026-23778

EUVD-2026-23396 HIGH

Command Injection (CWE-77)

2026-04-17 dell

GHSA-xpp5-4hhp-6qhr

Dell Command Injection

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 20, 2026 - 18:17 nvd

Patch available

Apr 17, 2026 - 10:01 EUVD

Analysis Updated

Apr 17, 2026 - 09:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 17, 2026 - 09:22 vuln.today

cvss_changed

Analysis Generated

Apr 17, 2026 - 09:15 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 09:00 euvd

EUVD-2026-23396

Analysis Generated

Apr 17, 2026 - 09:00 vuln.today

CVE Published

Apr 17, 2026 - 08:33 nvd

HIGH 7.2

DescriptionCVE.org

Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability to gain root-level access.

AnalysisAI

Command injection in Dell PowerProtect Data Domain DD OS versions 7.7.1.0-8.5 (Feature), 8.3.1.0-8.3.1.20 (LTS2025), and 7.13.1.0-7.13.1.50 (LTS2024) enables authenticated administrators with remote access to execute arbitrary commands as root. Dell DSA-2026-060 confirms patches in DD OS 8.6.0.0, 8.3.1.30, and 7.13.1.50. EPSS score of 0.05% (15th percentile) suggests low widespread exploitation risk despite network attack vector; no public exploit identified, CVSS 7.2 reflects high-privilege requirement limiting attack surface to compromised admin accounts or insider threats.

Technical ContextAI

Dell PowerProtect Data Domain is an enterprise backup appliance running the proprietary Data Domain Operating System (DD OS). CWE-77 (Command Injection) indicates improper neutralization of special elements in OS commands, allowing attackers to inject malicious shell metacharacters or command sequences into an application that invokes system commands. The CVSS vector shows network-accessible vulnerability (AV:N) with low attack complexity (AC:L), requiring high-privilege authentication (PR:H). CPE string cpe:2.3:a:dell:powerprotect_data_domain identifies affected product as Dell's PowerProtect Data Domain appliance across multiple release branches. The vulnerability likely exists in administrative interfaces or API endpoints where user input is passed unsanitized to shell interpreters, system() calls, or similar command execution mechanisms, enabling privilege escalation from admin to root level.

RemediationAI

Upgrade Dell PowerProtect Data Domain DD OS to patched versions confirmed by vendor advisory DSA-2026-060: Feature Release users upgrade to DD OS 8.6.0.0 or later, LTS2025 users upgrade to 8.3.1.30 or later, LTS2024 users upgrade to 7.13.1.50 or later. Download patches from Dell Support Portal referenced in advisory https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060. If immediate patching not feasible, implement compensating controls: restrict network access to DD OS administrative interfaces using firewall rules permitting only trusted management networks (blocks AV:N vector but impacts remote administration workflows), enforce multi-factor authentication for all administrative accounts (raises bar for credential theft), enable command logging and SIEM integration to detect anomalous root command execution patterns (detection-focused, does not prevent exploitation), and apply principle of least privilege by auditing and reducing number of accounts with high-privilege admin roles (shrinks attack surface but may conflict with operational requirements for distributed administration). Note that workarounds only reduce risk-patch deployment remains mandatory for secure operation of backup infrastructure.