Dell Cloud Disaster Recovery CVE-2026-70419

Exploitation requires high-privileged, authenticated access to Dell Cloud Disaster Recovery (CVSS PR:H) reachable over the network (AV:N); it is not remote-unauthenticated. The concrete prerequisite is the ability to reach and submit input to whichever administrative/job-configuration feature constructs OS commands, and to inject shell metacharacters into that input. Limiting factors: the attacker must already possess high privileges within the product, so the flaw is realistically an insider or post-credential-compromise privilege-to-host escalation rather than a first-stage entry point; no user interaction is needed (UI:N) and complexity is low (AC:L), so once that privileged access exists, exploitation is not otherwise gated by non-default configuration in the available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1) shows network reachability, low complexity, no user interaction, full C/I/A impact, and a scope change - but PR:H is the decisive limiter: exploitation presupposes an attacker who already holds high privileges within the product. That converts the primary risk from 'anonymous internet takeover' to 'privilege-to-host escalation and insider/post-compromise abuse.' There is no EPSS score, no KEV listing, and no POC in the provided data, so there is no evidence of active or automatable exploitation; the 9.1 is impact-weighted, not exploitation-weighted. The scope change (S:C) is the main reason the score is critical rather than high - verify with Dell whether S:C reflects genuine app-to-OS boundary crossing, as command injection is sometimes scored S:U. Net: patch on a normal-to-elevated cadence because impact is severe, but this is not a drop-everything internet-facing worm scenario given the PR:H precondition.

An attacker who has obtained high-privileged credentials to a Dell Cloud Disaster Recovery instance (via phishing, credential reuse, or a malicious insider) submits a request to a feature that builds an OS command, embedding shell metacharacters in a parameter such as a hostname, path, or job argument. The product concatenates that input into a shell invocation, executing the attacker's commands on the host with the service's privileges. No public exploit is available yet, and AC:L/UI:N mean that once privileged access is held, triggering the injection is straightforward and reliable.