What is the CVSS score of CVE-2026-49813?

CVE-2026-49813 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Is there a patch available for CVE-2026-49813?

Yes, a patch is available for CVE-2026-49813. Update the affected software to the latest version immediately.

PowerProtect Data Domain CVE-2026-49813

EUVD-2026-41553 MEDIUM

OS Command Injection (CWE-78)

2026-07-03 dell

GHSA-hx78-853f-cj6m

Command Injection Dell Powerprotect Data Domain

6.7

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.7 MEDIUM

Local access and high administrative privilege are both required per description; successful injection grants full OS command execution, justifying C:H/I:H/A:H within the unscoped vulnerable system.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 03, 2026 - 16:01 EUVD

Analysis Generated

Jul 03, 2026 - 15:17 vuln.today

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution.

AnalysisAI

OS command injection in Dell PowerProtect Data Domain across four supported release tracks allows a high-privileged local attacker to execute arbitrary operating system commands. Affected versions span the main release line (7.7.1.0-8.7) as well as LTS2024, LTS2025, and LTS2026 branch releases. No public exploit code or active exploitation has been identified at time of analysis; the local access and high-privilege prerequisites substantially constrain the realistic attack surface despite the full C/I/A impact scores.

Technical ContextAI

CWE-78 (Improper Neutralization of Special Elements used in an OS Command) describes a class of vulnerability where user-controlled input containing shell metacharacters is passed to a system shell without adequate sanitization, causing the shell to interpret injected tokens as separate commands. In the context of Dell PowerProtect Data Domain (CPE: cpe:2.3:a:dell:powerprotect_data_domain), this product is an enterprise backup deduplication appliance and software platform; its administrative CLI or management interfaces likely pass operator-supplied parameters to underlying OS commands. The AV:L designation in the CVSS vector confirms that exploitation occurs at the local system level, consistent with a privileged administrative shell or management function rather than a remotely exposed API.

RemediationAI

The primary remediation is to apply vendor-released patches per Dell Security Advisory DSA-2026-278 (https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities); specific fix versions for each release track are documented there and were not independently confirmed in the data available for this analysis. As compensating controls pending patching, restrict local administrative access to Data Domain appliances by enforcing jump-host or bastion-only access paths and auditing which accounts hold high-privilege roles - removing or disabling accounts that do not require administrative access reduces the exploitable surface. Enforcing multi-person authorization for privileged CLI operations, where operationally feasible, further limits insider exploitation; note this introduces operational overhead for routine administrative tasks. Ensure management network segments are isolated from general user access via VLAN segmentation.