EUVD-2026-23898Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an OS command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
AnalysisAI
OS command injection in Dell PowerProtect Data Domain allows authenticated administrative users with network access to execute arbitrary commands with root privileges. Affects multiple release branches (7.7.1.0-8.6, LTS2025 8.3.1.0-8.3.1.20, LTS2024 7.13.1.0-7.13.1.60). Dell released patches across all affected branches (8.6.1.10, 7.13.1.70, 8.3.1.30). EPSS data unavailable; no KEV listing or public exploit identified at time of analysis. While CVSS 7.2 reflects high impact, exploitation requires pre-existing high-privilege administrative credentials, significantly limiting real-world attack surface to insider threats or credential compromise scenarios.
Technical ContextAI
PowerProtect Data Domain is Dell's enterprise-grade backup appliance platform using deduplication storage technology. This vulnerability stems from CWE-78 (OS Command Injection), where insufficiently validated user input is passed to system shell commands. The affected CPE (cpe:2.3:a:dell:powerprotect_data_domain) encompasses multiple concurrent release branches: mainline (7.7.1.0 through 8.6), LTS2025 (8.3.1.x series), and LTS2024 (7.13.1.x series). The network attack vector (AV:N) indicates the vulnerable interface is remotely accessible through the appliance's management plane, likely via web UI, API, or CLI interfaces. Command injection vulnerabilities in privileged appliance contexts typically arise from inadequate sanitization of administrative input fields-such as backup job parameters, system configuration commands, or maintenance scripts-that are subsequently incorporated into shell command execution with elevated privileges.
RemediationAI
Apply Dell-released patches immediately: upgrade mainline deployments to version 8.6.1.10 or later (or migrate to 8.7.0.0+ if available), upgrade LTS2024 deployments to 7.13.1.70 or later, upgrade LTS2025 deployments to 8.3.1.30 or later, and upgrade PowerProtect Data Domain Management Center to 2.7.9 or later when managing DD OS 8.3.1.30. Download patches and detailed upgrade procedures from Dell Support as referenced in DSA-2026-060. If immediate patching is not feasible, implement compensating controls: restrict administrative access to Data Domain management interfaces using IP allowlisting at network firewall or appliance level (blocks unauthorized remote access vectors), enforce mandatory multi-factor authentication for all administrative accounts (raises credential compromise difficulty), implement privileged access management (PAM) with session recording for administrative sessions (provides detection capability), and monitor appliance system logs for unusual command execution patterns or privilege escalation attempts. Note that access restrictions may complicate remote administration workflows requiring VPN or jump host configurations; MFA may require integration with existing identity providers. These mitigations reduce but do not eliminate risk-patching remains the definitive remediation.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today