What is the CVSS score of CVE-2026-49814?

CVE-2026-49814 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.2%.

Which versions of Powerprotect Data Domain are affected by CVE-2026-49814?

Dell PowerProtect Data Domain (versions 7.7.1.0-8.7 and LTS2026/2025/2024 branches) contains an arbitrary OS command execution vulnerability exploitable by remotely-authenticated attackers with…. A patch is available.

How to fix or mitigate CVE-2026-49814?

24 hours: Enumerate all PowerProtect Data Domain appliances running versions 7.7.1.0-8.7 or LTS2026/2025/2024; restrict network access to management consoles to essential personnel only; review and strengthen access controls on privileged administrative accounts. 7 days: Review Dell advisory DSA-2026-278 for interim security guidance; contact Dell support to identify unaffected versions and upgrade path feasibility. 30 days: Deploy monitoring and alerting for elevated-privilege command execution on all Data Domain systems; execute plan to upgrade or migrate away from vulnerable versions to unaffected releases.

Powerprotect Data Domain CVE-2026-49814

EUVD-2026-41551 HIGH

OS Command Injection (CWE-78)

2026-07-03 dell

GHSA-j98v-6jpg-29m4

Command Injection Dell Powerprotect Data Domain

7.2

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (dell) · only source for this CVE.

CVSS VectorVendor: dell

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 03, 2026 - 16:01 EUVD

Analysis Generated

Jul 03, 2026 - 15:17 vuln.today

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.

AnalysisAI

Arbitrary OS command execution in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.7, plus the LTS2026, LTS2025 and LTS2024 branches) lets a high-privileged, remotely-authenticated attacker run operating-system commands on the backup appliance by injecting special characters into an OS command context. The flaw was reported by Dell and is addressed in advisory DSA-2026-278; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because it grants full command execution on a data-protection appliance, successful exploitation can compromise the confidentiality, integrity and availability of backup data.