Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain contains an OS command injection vulnerability affecting multiple versions. A high privileged attacker with remote access could exploit this vulnerability, leading to arbitrary command execution with root privileges. This poses a significant risk to the integrity and confidentiality of the system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.2 | CVE-2026-26943 |
Exploitation
To exploit this vulnerability, an attacker must have high privileges and remote access to the affected system. By sending specially crafted commands to the system, the attacker can execute arbitrary commands with root privileges, potentially compromising the entire system.
Affected Products
- PowerProtect Data Domain versions 7.7.1.0 through 8.6
- LTS2025 release version 8.3.1.0 through 8.3.1.20
- LTS2024 release versions 7.13.1.0 through 7.13.1.60
Mitigation
It is recommended to apply the latest security updates provided by Dell to mitigate this vulnerability. Users should ensure that their systems are updated to the latest versions to protect against potential exploitation.