Dell PowerProtect Data Domain EUVD-2026-111842

Exploitation requires an authenticated, low-privileged account (CVSS PR:L; the description states 'a low privileged attacker') with remote network access to the appliance (AV:N), and no user interaction (UI:N). The specific product feature, management interface, protocol, or command-processing function that accepts the unneutralized input is not described in the available sources, so defenders cannot scope exploitation to a particular setting or SAPI from this data. The principal limiting factor is the credential prerequisite: an attacker must already possess valid low-level access to the Data Domain system, so unauthenticated internet exposure alone is not sufficient. Affected deployments are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the fixed versions are not provided in the supplied reference metadata and should be confirmed against Dell DSA-2026-416.

This is a credible, prioritize-this-week issue rather than a theoretical high-CVSS flaw, but the available signals are thin and partly missing. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a low-complexity, network-reachable OS command injection requiring only low privileges and no user interaction, with full High impact to confidentiality, integrity, and availability (C:H/I:H/A:H) - on a backup/storage appliance that holds an organization's recovery data, that impact profile is severe because compromise undermines the very system defenders rely on after an incident. However, several decision signals present in a full triage are absent here: no EPSS exploitation-probability score is provided, the vulnerability is NOT listed in CISA KEV, and no POC or exploit reference appears in the input. The vuln.today decision label is 'this_week', which is an elevated-but-not-emergency priority consistent with a serious authenticated flaw lacking confirmed active exploitation. There is no conflict between the CVSS network vector and the description - the description explicitly states 'remote access' and 'low privileged attacker', matching AV:N and PR:L - so the authentication requirement (authenticated, low-privilege) is confirmed. The key limiting factor is that exploitation requires existing low-privileged credentials on the appliance, which bounds the realistic attacker set to insiders or anyone who has already obtained valid low-level access.

An attacker who already holds low-privileged, remotely-reachable credentials on a Dell PowerProtect Data Domain appliance submits input containing unneutralized shell metacharacters to an affected interface, causing the appliance to execute attacker-chosen OS commands. Because the appliance is a backup/recovery platform, resulting command execution could expose or tamper with stored backup data and the appliance itself. No public exploit identified at time of analysis, and the exact injectable feature is not described in the available sources.