EUVD-2026-41537
GHSA-fh65-mw6q-c8vh
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Network-accessible management interface requires high-privilege credentials; no confidentiality impact described; full integrity and availability loss on the appliance matches OS command injection with admin-level execution.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special Elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.
AnalysisAI
OS command injection in Dell PowerProtect Data Domain across four version release trains allows a high-privileged remote attacker to execute arbitrary operating system commands on the appliance. Affected products span mainline versions 7.7.1.0 through 8.7 and three LTS branches, confirmed by Dell Security Advisory DSA-2026-278. No public exploit identified at time of analysis and the CVE is absent from CISA KEV; however, the high integrity and availability impact (I:H/A:H) on a backup appliance makes patching urgent for environments where backup infrastructure is shared or admin credentials are broadly distributed.
Technical ContextAI
Dell PowerProtect Data Domain is a purpose-built backup and deduplication appliance widely deployed in enterprise data centers to protect primary storage. The vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements Used in an OS Command), meaning attacker-controlled input reaches a system shell call without adequate sanitization of shell metacharacters such as semicolons, pipes, or backticks. The management interface is network-accessible (AV:N), and while exploitation requires a high-privileged account (PR:H), the flaw allows direct OS-level command execution rather than being limited to application-layer operations. The unchanged scope (S:U) indicates impact is contained to the Data Domain appliance itself. Affected streams include mainline (7.7.1.0-8.7), LTS2026 (8.6.1.0-8.6.1.10), LTS2025 (8.3.1.0-8.3.1.30), and LTS2024 (7.13.1.0-7.13.1.70), indicating the injection point exists across a long-standing code path common to multiple sustained release branches.
RemediationAI
Administrators should apply the patched versions specified in Dell Security Advisory DSA-2026-278 (https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities) for their applicable release stream - exact fix versions are not independently confirmed from the available intelligence data and must be obtained directly from the advisory, which covers multiple vulnerabilities in this release. As compensating controls while patching is staged, restrict network access to the Data Domain management interface to a dedicated, firewalled management VLAN accessible only from trusted administrator workstations - this reduces exposure without eliminating the vulnerability. Enforce multi-factor authentication on all high-privileged accounts and audit current admin account membership to minimize the number of accounts that could be leveraged. Monitor the appliance for anomalous CLI or shell activity. Note that network restriction mitigates remote exploitation but does not protect against a compromised jump host or insider on the management network.
More in Data Domain Operating System
View allDell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficie
Improper authorization enforcement in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.6, plus LTS branches 8.6
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection v
Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. Ra
Denial of service in Dell PowerProtect Data Domain (DDOS versions 7.7.1.0 through 8.7, plus LTS2026 8.6.1.0-8.6.1.10, LT
Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of
Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerab
Stored cross-site scripting in Dell PowerProtect Data Domain (DD OS 7.7.1.0 through 8.7, plus the LTS2026 8.6.1.x, LTS20
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path t
OS command injection in Dell PowerProtect Data Domain enables a high-privileged local attacker to execute arbitrary oper
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.
Dell PowerProtect DD, versions prior to 7.7.5.50, contains an Exposure of Sensitive Information to an Unauthorized Actor
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today