An OS Command Injection vulnerability in Dell PowerProtect Data Domain allows authenticated administrative users to gain unauthorized command execution capabilities on the underlying system.

Similar to related vulnerabilities in this suite, this issue involves improper neutralization of special elements used in OS commands, allowing an authenticated administrator to inject and execute arbitrary commands.

The CVSS score of 7.2 indicates a high severity risk. While exploitation requires administrative credentials, the ability to execute arbitrary OS commands on a data protection appliance allows for the potential loss of data integrity and availability, which could severely impact business operations and recovery capabilities.

Immediate Action: Apply the vendor-supplied security updates to reach the corrected versions (8.8.0.0, 8.6.1.20, 8.3.1.40, 7.13.1.80 or later) as referenced in DSA-2026-278.

Proactive Monitoring: Review system logs for unexpected process execution or modifications to system binaries by administrative accounts.

Compensating Controls: Limit access to the management console to authorized personnel only and implement Multi-Factor Authentication (MFA) to prevent unauthorized credential usage.

Public Exploit Available: false

The severity of this command injection vulnerability necessitates prompt remediation. Organizations should prioritize patching their PowerProtect Data Domain systems and review administrative access logs to ensure no prior unauthorized activity has occurred.