A critical OS command injection vulnerability in Dell PowerProtect Data Manager allows low-privileged local attackers to achieve full command execution, necessitating immediate patching.

The application is susceptible to an OS command injection flaw (CWE-78) within its Hyper-V integration. A low-privileged, authenticated local user can leverage this vulnerability to execute arbitrary commands on the underlying operating system.

This vulnerability carries a CVSS score of 7.8, indicating a high level of risk due to the potential for total system compromise. Successful exploitation grants an attacker full command execution capabilities, which could lead to unauthorized data access, system disruption, or further lateral movement within the network. Given that this affects critical backup and data management infrastructure, the impact on business continuity and data integrity is severe.

Immediate Action: Upgrade Dell PowerProtect Data Manager to version 19.21 build 11 or later as specified in the official vendor advisory (DSA-2025-326).

Proactive Monitoring: Review system access logs for any suspicious command execution patterns or unauthorized local access attempts originating from low-privileged service accounts.

Compensating Controls: Restrict local system access to the PowerProtect Data Manager server to only essential personnel and ensure that the principle of least privilege is strictly enforced for all local user accounts.

Public Exploit Available: Unknown

The severity of this command injection vulnerability requires prompt administrative attention. IT teams should prioritize the update to version 19.21 build 11 to eliminate the injection vector. Continued vigilance regarding local account security is essential to prevent unauthorized actors from reaching the threshold required to execute this exploit.