Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain versions 8.5 through 8.6 contain an OS command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. This could result in significant security risks for affected systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2026-26942 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and remote access to the affected system. By injecting specially crafted commands into the OS command execution process, the attacker can execute arbitrary commands with root privileges, potentially compromising the entire system.
Affected Products
- PowerProtect Data Domain 8.5 – Vulnerable to OS command injection, allowing for arbitrary command execution.
- PowerProtect Data Domain 8.6 – Similar vulnerabilities as 8.5, with the same potential for exploitation.
Mitigation
To mitigate this vulnerability, users should apply the latest security updates provided by Dell. It is also recommended to limit remote access to the affected systems and monitor for any suspicious activity that may indicate exploitation attempts.