EUVD-2026-41536
GHSA-jcxg-c4c8-fvg9
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Local vector and high privilege requirement reflect CLI/shell access by admin; full C/I/A impact warranted by arbitrary OS command execution on the appliance.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
AnalysisAI
OS command injection in Dell PowerProtect Data Domain enables a high-privileged local attacker to execute arbitrary operating system commands on the backup appliance, achieving full command execution within the Data Domain OS (DDOS). The flaw spans the general release track (7.7.1.0-8.6) and three LTS streams (LTS2024, LTS2025, LTS2026), indicating a shared vulnerable code path across a wide version surface. No public exploit code or CISA KEV listing exists at time of analysis, and the PR:H/AV:L prerequisites meaningfully constrain real-world risk to insider threats or post-compromise scenarios.
Technical ContextAI
CWE-78 (Improper Neutralization of Special Elements used in an OS Command) describes a class of flaws where user-supplied input is interpolated into a shell command string without adequate sanitization or escaping, allowing an attacker to inject additional OS commands that the interpreter executes. Dell PowerProtect Data Domain is a purpose-built deduplication storage appliance running Dell's proprietary Data Domain OS (DDOS), widely deployed as backup target infrastructure. The CVSS local attack vector (AV:L) indicates the injection point is reachable through a local management interface - such as the DDOS CLI or an authenticated administrative shell - rather than an unauthenticated network service. No CPE strings were provided in the source data. The breadth of affected version ranges across the general release and three distinct LTS tracks (7.x, 8.3.x, 8.6.x) suggests the vulnerability exists in a shared internal component or command-processing library common to all these release lines.
RemediationAI
Apply the vendor-supplied patch as documented in Dell advisory DSA-2026-278 (https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities). The advisory covers multiple CVEs in a single bulletin, so administrators should consult it directly to identify the exact target fixed version for their specific release track (general, LTS2024, LTS2025, or LTS2026) - exact patched version numbers were not included in the provided source data and should not be inferred. As compensating controls prior to patching, restrict high-privileged CLI and management shell access to the minimum set of trusted administrators using role-based access controls; enabling MFA for privileged accounts reduces the risk of credential-based access that would be a prerequisite for exploitation. Audit and review existing admin-level accounts and active sessions on affected appliances. Network-level controls (blocking remote management access from untrusted segments) have limited effectiveness given the local attack vector but reduce the risk of remote attackers pivoting to use compromised credentials.
More in Data Domain Operating System
View allDell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficie
Improper authorization enforcement in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.6, plus LTS branches 8.6
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection v
Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. Ra
Denial of service in Dell PowerProtect Data Domain (DDOS versions 7.7.1.0 through 8.7, plus LTS2026 8.6.1.0-8.6.1.10, LT
Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of
Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerab
Stored cross-site scripting in Dell PowerProtect Data Domain (DD OS 7.7.1.0 through 8.7, plus the LTS2026 8.6.1.x, LTS20
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path t
OS command injection in Dell PowerProtect Data Domain across four version release trains allows a high-privileged remote
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.
Dell PowerProtect DD, versions prior to 7.7.5.50, contains an Exposure of Sensitive Information to an Unauthorized Actor
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today