EUVD-2026-23886
GHSA-c3x5-j788-wjpm
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
7DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an OS command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution as root.
AnalysisAI
OS command injection in Dell PowerProtect Data Domain versions 7.7.1.0-8.6, LTS2025 8.3.1.0-8.3.1.20, and LTS2024 7.13.1.0-7.13.1.60 allows high-privileged remote attackers to execute arbitrary commands as root. Network-accessible exploitation requires existing administrative credentials but minimal attack complexity (CVSS:3.1/AV:N/AC:L/PR:H). No active exploitation confirmed (not in CISA KEV). Vendor patch available per DSA-2026-060, addressing CWE-78 command injection weakness in multiple product streams including LTS releases.
Technical ContextAI
This vulnerability affects Dell PowerProtect Data Domain, an enterprise deduplication storage appliance for backup and disaster recovery environments. The OS command injection (CWE-78) occurs when the application constructs system commands using attacker-controlled input without proper sanitization or validation. The affected CPE (cpe:2.3:a:dell:powerprotect_data_domain) spans multiple release streams: standard releases 7.7.x-8.6.x, LTS2025 (8.3.1.x branch), and LTS2024 (7.13.1.x branch). Command injection at the operating system level enables shell metacharacter injection, allowing attackers to append malicious commands that execute with the privileges of the underlying process-in this case, root access on the DD OS appliance. The network attack vector (AV:N) suggests exploitation through a remote management interface or API requiring high-level authentication.
RemediationAI
Apply vendor-released patches per DSA-2026-060: upgrade to DD OS 8.3.1.30 or later for LTS2025 releases, 7.13.1.70 or later for LTS2024 releases, or 8.6.1.10/8.7.0.0 or later for standard 8.6.x/8.7.x branches. For environments unable to immediately patch, implement compensating controls: restrict network access to PowerProtect Data Domain management interfaces using firewall rules permitting only trusted administrative jump hosts or VPN gateways (eliminating direct internet exposure), enforce multi-factor authentication for all administrative accounts, enable audit logging for command execution and review for anomalous activity, apply principle of least privilege by segregating day-to-day admin tasks from root-equivalent operations where DD OS RBAC permits. Note that network restrictions reduce remote exploit surface but do not eliminate risk from compromised internal admin accounts. Audit current admin account distribution and revoke unnecessary elevated access. Consult DSA-2026-060 for release-specific upgrade paths and potential side effects of patching LTS versus standard release streams.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today