Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain a missing authentication for critical function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. Exploitation requires an authenticated user to perform a specific action.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2026-26944 |
Exploitation
To exploit this vulnerability, an attacker must first gain authenticated access to the system. Once authenticated, the attacker can perform specific actions that trigger the vulnerability, allowing them to execute arbitrary commands with root privileges. This could lead to a complete compromise of the affected system.
Affected Products
- PowerProtect Data Domain versions 7.7.1.0 through 8.6
- LTS2025 release version 8.3.1.0 through 8.3.1.20
- LTS2024 release versions 7.13.1.0 through 7.13.1.60
Mitigation
To mitigate this vulnerability, it is recommended to apply the latest security updates provided by Dell. Users should ensure that their systems are updated to the latest versions and follow best practices for user authentication and access control to minimize the risk of exploitation.