EUVD-2026-23885
GHSA-5f9j-32h2-hhg6
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionCVE.org
Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain an improper input validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
AnalysisAI
Arbitrary command execution with root privileges in Dell PowerProtect Data Domain versions 8.5 through 8.6 allows high-privileged remote attackers to escalate from administrative access to full system control via improper input validation. Dell has released patches (versions 2.7.9 with DD OS 8.3.1.30, and 8.6.1.10+) per DSA-2026-060. EPSS data not available, not listed in CISA KEV, suggesting targeted risk rather than widespread exploitation. The network attack vector (AV:N) combined with high privilege requirement (PR:H) indicates this is an admin-to-root escalation vulnerability rather than initial access.
Technical ContextAI
PowerProtect Data Domain is Dell's enterprise data protection and deduplication storage appliance running a specialized operating system (DD OS). This vulnerability stems from CWE-20 (Improper Input Validation), where the system fails to adequately sanitize or validate input provided through a network-accessible administrative interface. The affected CPE (cpe:2.3:a:dell:powerprotect_data_domain) indicates this is an application-layer vulnerability in the Data Domain software stack itself, not the underlying OS. Given the requirement for high privileges (PR:H) and the ability to execute commands as root, this represents a classic privilege escalation from administrative user to system root, likely through command injection or parameter manipulation in admin-accessible management functions. The network attack vector suggests exploitation occurs through web-based management interfaces, CLI over SSH, or API endpoints that accept administrative commands.
RemediationAI
Dell has released patches addressing this vulnerability per DSA-2026-060. For systems running DD OS 8.3.1.30, upgrade PowerProtect Data Domain to version 2.7.9 or later. For DD OS 8.5-8.6 series, upgrade to version 8.6.1.10 or later, or migrate to version 8.7.0.0 which is not affected. Download patches and detailed upgrade procedures from the Dell support advisory at https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities. If immediate patching is not feasible, implement compensating controls: restrict administrative access to PowerProtect Data Domain systems to jump hosts or bastion servers only (eliminates direct internet exposure for AV:N vector), enforce hardware MFA for all administrative accounts (raises attacker cost for PR:H requirement), enable comprehensive command logging and SIEM alerting for unusual root-level activity (detection control), and network-segment Data Domain management interfaces from general corporate networks (contains lateral movement). Note that these mitigations do not eliminate the vulnerability but reduce attack surface; patches should be applied during the next available maintenance window. Restricting network access may impact legitimate remote administration workflows and requires coordination with backup operations teams.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today