Dell PowerProtect Data Domain Management Center CVE-2026-86379

Exploitation requires the attacker to already hold high (administrative) privileges on the Dell PowerProtect Data Domain Management Center (CVSS PR:H); it is not reachable by an unauthenticated or low-privileged remote attacker. Given that precondition, the flaw is remotely exploitable over the network with low complexity and no user interaction (AV:N/AC:L/UI:N) against affected versions: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The primary limiting factor is the required administrative authentication level; the specific feature, parameter, or configuration that carries the injectable input is not described in the available sources.

This is a moderate-severity, authenticated OS command injection (CWE-78) in Dell PowerProtect Data Domain Management Center, scored CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The attack vector is network with low complexity and no user interaction, but PR:H means the attacker must already hold high (administrative) privileges on the management center, which substantially narrows the realistic threat population to insiders or attackers who have already compromised an admin account. There is no KEV listing, so there is no confirmed active exploitation; no EPSS score was provided in the input, so exploitation probability cannot be quantified here; and no public exploit or PoC was identified. The signals are internally consistent: a genuine remote-exploitable flaw with full C/I/A impact, but gated behind high privilege, which is why the vendor priority is 'this_week' rather than emergency/act_now. Net assessment: a real issue worth patching on a near-term cycle, not a drop-everything emergency, because the high-privilege precondition - not CVSS magnitude - is the dominant risk limiter. The main caveat is the absence of EPSS and any independent corroboration beyond the single Dell advisory.

An attacker who already possesses high-privilege (administrative) access to the Dell PowerProtect Data Domain Management Center sends a crafted request to a management function that fails to neutralize special shell characters, injecting OS commands that execute on the underlying appliance. This yields command execution with full confidentiality, integrity, and availability impact over the backup management plane. No public exploit code was identified at time of analysis, and the specific vulnerable function/parameter is not described in the available sources.