What is the CVSS score of CVE-2026-53478?

CVE-2026-53478 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.2%.

Which versions of PowerProtect Data Domain are affected by CVE-2026-53478?

A command injection flaw in Dell PowerProtect Data Domain backup systems (versions 7.7.1.0-8.7 and LTS releases) allows authenticated administrators to execute arbitrary commands with full system…

How to fix or mitigate CVE-2026-53478?

Within 24 hours: Audit all administrative accounts and review Data Domain activity logs for suspicious access or commands. Within 7 days: Implement network segmentation for appliances, enforce MFA for admin accounts, and disable unnecessary administrative access. Within 30 days: Subscribe to Dell security advisories, develop patching procedures in isolated test environment, and deploy immediately upon patch release.

PowerProtect Data Domain CVE-2026-53478

EUVD-2026-41548 HIGH

OS Command Injection (CWE-78)

2026-07-03 dell

GHSA-q3qg-f4rw-mrf7

Command Injection Dell Powerprotect Data Domain

7.2

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable management plane (AV:N) with low complexity (AC:L) but requires an existing high-privileged admin account (PR:H); OS command execution yields full C/I/A impact on the appliance.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (dell).

CVSS VectorVendor: dell

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 15:15 vuln.today

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.

AnalysisAI

Authenticated OS command injection in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.7, plus LTS2026 8.6.1.0-8.6.1.10, LTS2025 8.3.1.0-8.3.1.30, and LTS2024 7.13.1.0-7.13.1.70) lets a high-privileged remote attacker inject arbitrary operating-system commands and execute them on the appliance. Successful exploitation yields full confidentiality, integrity, and availability impact (CVSS 7.2), effectively giving an authenticated administrator command execution on the underlying OS of a backup/data-protection system. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Dell PowerProtect Data Domain (formerly EMC Data Domain / DDOS) is a purpose-built backup appliance and deduplication storage system central to enterprise data-protection and disaster-recovery workflows. The flaw is CWE-78, improper neutralization of special elements used in an OS command ('OS Command Injection'), which occurs when user-controllable input is passed into a shell or system command without adequate sanitization, allowing shell metacharacters to break out of the intended command and execute attacker-supplied commands. In appliance/management-interface software like DDOS, such issues typically arise in administrative CLI/API operations that shell out to underlying utilities. The affected component maps to CPE cpe:2.3:a:dell:powerprotect_data_domain across the listed versions; Dell has not published finer-grained sub-component detail in the available data.

RemediationAI

Apply the fixed Dell PowerProtect Data Domain (DDOS) releases published in Dell advisory DSA-2026-278 for your specific maintenance train - mainline, LTS2026 (8.6.1.x), LTS2025 (8.3.1.x), or LTS2024 (7.13.1.x); consult https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities for the exact patched build matching your version, as the input does not enumerate a single fixed version. Because exploitation requires high administrative privilege (PR:H), the strongest compensating control until patching is to tightly restrict and monitor administrative access: limit management-plane reachability to a dedicated, firewalled management network or bastion, enforce strong/MFA-backed admin authentication, minimize the number of privileged accounts, and enable audit logging on administrative CLI/API actions to detect command-injection attempts. These network-restriction controls have the trade-off of complicating legitimate remote administration and monitoring integrations, so validate management workflows before locking down access.