EUVD-2026-41551
GHSA-j98v-6jpg-29m4
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 03, 2026
Arbitrary OS command execution in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.7, plus the LTS2026, LTS2025 and LTS2024 branches) lets a high-privileged, remotely-authenticated attacker run operating-system commands on the backup appliance by injecting special characters into an OS command context. The flaw was reported by Dell and is addressed in advisory DSA-2026-278; no public exploit identified at time of analysis and it is not listed in CISA KEV. Because it grants full command execution on a data-protection appliance, successful exploitation can compromise the confidentiality, integrity and availability of backup data.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Powerprotect Data Domain gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (dell) · only source for this CVE.
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution.
Executive ViewAI
Dell PowerProtect Data Domain (versions 7.7.1.0-8.7 and LTS2026/2025/2024 branches) contains an arbitrary OS command execution vulnerability exploitable by remotely-authenticated attackers with high-privilege credentials, exposing all backed-up organizational data to compromise. Since backup systems are the final recovery point during data breaches or operational incidents, successful exploitation renders backup and recovery capabilities ineffective at a critical moment. No vendor patch currently exists, requiring immediate containment measures.
24 hours: Enumerate all PowerProtect Data Domain appliances running versions 7.7.1.0-8.7 or LTS2026/2025/2024; restrict network access to management consoles to essential personnel only; review and strengthen access controls on privileged administrative accounts. 7 days: Review Dell advisory DSA-2026-278 for interim security guidance; contact Dell support to identify unaffected versions and upgrade path feasibility. 30 days: Deploy monitoring and alerting for elevated-privilege command execution on all Data Domain systems; execute plan to upgrade or migrate away from vulnerable versions to unaffected releases.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to Data Domain administrative interfaces via firewall and network segmentation; (2) Enforce multi-factor authentication on all administrative accounts; (3) Monitor and alert on elevated-privilege command execution and administrative access; (4) Apply least-privilege restrictions to administrative accounts; (5) Isolate backup appliance from general production networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
More in Powerprotect Data Domain
View allPath traversal leading to full system compromise affects Dell PowerProtect Data Domain (DD OS) versions 7.7.1.0 through
Improper authentication in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.7, plus the LTS2026, LTS2025, and L
Remote, unauthenticated attackers can obtain exposed credentials from Dell PowerProtect Data Domain appliances running F
Stack-based buffer overflow in Dell PowerProtect Data Domain DD OS allows remote unauthenticated attackers to execute ar
Unauthenticated remote command execution is possible on Dell PowerProtect Data Domain appliances running Feature Release
Improper authentication in Dell PowerProtect Data Domain allows remote unauthenticated attackers to bypass authenticatio
Privilege escalation in Dell PowerProtect Data Domain Feature Release 7.7.1.0 through 8.8 allows an authenticated, low-p
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficie
Improper certificate validation in Dell PowerProtect Data Domain DD OS 7.7.1.0-8.5, 8.3.1.0-8.3.1.20 (LTS2025), and 7.13
Stack-based buffer overflow in Dell PowerProtect Data Domain allows a low-privileged authenticated remote attacker to po
Dell PowerProtect Data Domain appliances running Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80
Local attackers can gain full system access to Dell PowerProtect Data Domain storage systems without authentication due
Exploit-DB