What is the CVSS score of CVE-2026-49815?

CVE-2026-49815 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.1%.

Which versions of PowerProtect Data Domain are affected by CVE-2026-49815?

Dell PowerProtect Data Domain backup appliances contain an authenticated command-execution vulnerability that permits high-privileged administrators to bypass application controls and execute…. A patch is available.

How to fix or mitigate CVE-2026-49815?

Within 24 hours: Inventory all Dell PowerProtect Data Domain appliances; identify systems running versions 7.7.1.0 through 8.7 or LTS2024/LTS2025/LTS2026 maintenance branches; restrict administrative access to documented business-need basis only. Within 7 days: Audit administrative account activity logs for anomalous command execution; disable remote administrative protocols (SSH, web console) where operationally feasible; escalate any suspicious administrative activity. Within 30 days: Monitor vendor advisory DSA-2026-278 for patch availability; develop and stage upgrade plan to patched version when released; if no patch released within 60 days, implement network segmentation restricting administrative access.

PowerProtect Data Domain CVE-2026-49815

EUVD-2026-41549 HIGH

OS Command Injection (CWE-78)

2026-07-03 dell

GHSA-363q-xrjc-rqpj

Command Injection Dell Powerprotect Data Domain

7.2

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Remote management access with low complexity but requires existing high-privilege admin account (PR:H); command injection into the OS yields full C/I/A impact on the appliance without scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 03, 2026 - 16:01 EUVD

Analysis Generated

Jul 03, 2026 - 15:15 vuln.today

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special Elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to execution of arbitrary OS commands.

AnalysisAI

OS command injection in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.7, plus the LTS2026, LTS2025, and LTS2024 maintenance branches) lets an authenticated high-privileged remote attacker execute arbitrary operating-system commands on the appliance via improperly neutralized special characters (CWE-78). Because the attacker already holds elevated privileges, the flaw functions as a privilege-boundary and integrity break - turning administrative access into full underlying-OS command execution with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was reported by Dell and fixed in advisory DSA-2026-278.

Technical ContextAI

Dell PowerProtect Data Domain is a purpose-built backup and deduplication storage appliance (formerly EMC Data Domain / DDOS) used as a protection-storage target for enterprise backup workloads. The affected component is identified by CPE cpe:2.3:a:dell:powerprotect_data_domain and spans the mainline 7.7.1.0-8.7 train as well as the long-term-support branches (LTS2026 8.6.1.x, LTS2025 8.3.1.x, LTS2024 7.13.1.x). The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): a management interface or CLI operation passes attacker-influenced input into a shell/OS command context without adequate sanitization, so shell metacharacters (e.g. ;, |, &, backticks, $()) break out of the intended command and run additional operating-system commands on the appliance.

RemediationAI

Apply the fixed Data Domain OS (DDOS) release for your track as published in Dell advisory DSA-2026-278 (https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities); the exact patched build numbers are not enumerated in the provided input, so consult the advisory for the specific fixed version corresponding to your mainline (7.7.1.0-8.7) or LTS (8.6.1.x, 8.3.1.x, 7.13.1.x) branch - treat this as 'patch available per vendor advisory' rather than an independently confirmed version. Until patched, reduce exposure by restricting network reachability of the appliance management/CLI interfaces to a dedicated administrative management network or jump host, tightening and auditing which accounts hold high-privilege (admin/sysadmin) roles since PR:H is the exploitation gate, enforcing strong authentication and rotating administrative credentials, and enabling logging/alerting on administrative command activity; the trade-off of network restriction is that legitimate remote administration must route through the approved management path.