EUVD-2026-23895Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
AnalysisAI
OS command injection in Dell PowerProtect Data Domain versions 8.5 through 8.6 allows high-privileged remote attackers to execute arbitrary commands with root privileges by exploiting improper neutralization of special elements in OS command processing. This vulnerability requires high privilege level access but, once exploited, grants full system compromise. No active exploitation or public exploit code has been identified at time of analysis, but vendor has released patches addressing the issue.
Technical ContextAI
Dell PowerProtect Data Domain is a deduplication storage appliance. The vulnerability stems from CWE-78 (OS Command Injection), a class of flaw where untrusted input is concatenated into OS command strings without proper sanitization or parameterization. When special shell metacharacters (pipe, semicolon, backticks, command substitution syntax) are not neutralized, an attacker with high privileges can inject additional commands that execute with the same privilege context as the vulnerable process. In this case, the injection occurs in code paths accessible to high-privileged users, resulting in command execution as root. The attack surface is limited by the requirement for high privilege level (PR:H) and local attack vector (AV:L), meaning the attacker must already have elevated administrative or service account access on the system.
RemediationAI
Dell has released vendor patches addressing this vulnerability. Organizations should upgrade PowerProtect Data Domain to version 8.6.1.10 or later (8.7.0.0 and later are patched according to EUVD data), or apply patches to DD OS 8.3.1.30 and later for older 2.x versions. The official Dell security advisory DSA-2026-060 (available at https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities) provides detailed patch instructions and version mapping. While patches are being deployed, implement compensating controls: restrict administrative access to PowerProtect Data Domain management interfaces using network segmentation and firewall rules to limit who can reach high-privilege functions; disable or restrict unused administrative protocols (SSH, REST API) if not required; audit and rotate high-privilege service account credentials to minimize the blast radius if a credential is compromised; implement command execution logging and alerting on the Data Domain to detect anomalous OS commands executed as root. These controls do not eliminate the vulnerability but reduce the likelihood of exploitation.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today