CVE-2026-26355 Dell PowerProtect Data Domain OS Command Injection Vulnerability

Technical summary

CVE-2026-26355 is an OS command injection vulnerability (CWE-78) in Dell PowerProtect Data Domain stemming from improper neutralization of special characters in command construction. The vulnerability exists in versions 7.7.1.0 through 8.7 (standard release), 8.6.1.0 through 8.6.1.10 (LTS2026), 8.3.1.0 through 8.3.1.30 (LTS2025), and 7.13.1.0 through 7.13.1.70 (LTS2024). An attacker with high privilege context and network access can inject OS commands through an unvalidated input vector, resulting in arbitrary command execution with the privileges of the running process. The CVSS 3.1 score of 6.5 (MEDIUM) reflects the requirement for high-privilege access (PR:H) as a mitigating factor, though integrity and availability impacts are rated high once exploited.

Business impact

Unauthorized command execution on Data Domain systems could lead to data exfiltration, system manipulation, or denial of service—critical concerns for backup and disaster recovery infrastructure. Since Data Domain is a deduplication appliance handling sensitive backup data, a compromised instance could expose protected data across multiple protected environments. The requirement for high-privilege access limits exposure to insider threats and compromised administrative accounts, but does not eliminate risk in multi-tenant or federated environments.

Affected systems

Dell PowerProtect Data Domain is affected across multiple release tracks: standard versions 7.7.1.0–8.7, LTS2026 versions 8.6.1.0–8.6.1.10, LTS2025 versions 8.3.1.0–8.3.1.30, and LTS2024 versions 7.13.1.0–7.13.1.70. Organizations running any of these versions should audit their deployment scope. Verify your exact version against the Data Domain system interface or administrative tooling before assuming patched status.

Exploitability

Exploitation requires high-privileged attacker access and network connectivity to the vulnerable system. These preconditions reduce opportunistic exploitation risk compared to unauthenticated vulnerabilities. However, threat actors with access to compromised administrative credentials—via phishing, lateral movement, or third-party compromise—could weaponize this flaw. The CVSS vector reflects no additional complexity (AC:L) once authentication is achieved. This remains a realistic risk in environments with inadequate credential hygiene or privileged account segmentation.

Remediation

Dell has issued patches for all affected release branches. Organizations must identify which Data Domain versions are deployed, cross-reference against Dell's published fix versions for each release track, and apply patches according to their change management schedule. Given the high-privilege requirement, interim compensating controls—such as restricting administrative access, enforcing multi-factor authentication for privileged accounts, and network segmentation of Data Domain systems—can reduce exploitation likelihood while patches are validated and deployed.

Patch guidance

Contact Dell support or consult Dell's security advisory for CVE-2026-26355 to obtain the specific patched version numbers for each affected release branch (standard, LTS2026, LTS2025, LTS2024). Patch availability and release dates vary by branch. Test patches in a non-production environment before deploying to production backup systems to ensure compatibility with your backup workflows and any third-party integrations. Document pre- and post-patch system health metrics.

Detection guidance

Monitor Data Domain system logs for unusual OS command execution, particularly commands invoked through administrative interfaces or API endpoints. Look for evidence of command injection syntax (shell metacharacters, pipe operators, or redirection symbols) in audit logs or error messages. Implement file integrity monitoring on critical system binaries and configuration files. Network-based detection should focus on anomalous administrative API calls or authentication patterns from unexpected sources. Consider deploying Data Domain-specific SIEM rules or enabling enhanced logging if available in your version.

Why prioritize this

Although rated MEDIUM severity, this vulnerability warrants prioritization in environments where Data Domain systems handle sensitive or regulatory-protected backup data. The high-privilege requirement and lack of CISA KEV designation reduce immediate exploitation urgency, but the potential for data breach through a compromised administrative account—combined with the centralized, high-value nature of backup infrastructure—justifies treating this as high-impact in your risk context. Organizations with mature administrative access controls and MFA can deprioritize relative to unauthenticated vulnerabilities; those without should accelerate patching.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a MEDIUM severity rating driven by the requirement for high-privilege attacker status (PR:H), which significantly reduces the attack surface. However, this score does not capture the business criticality of Data Domain systems themselves—backup infrastructure that, if compromised, can undermine recovery capabilities organization-wide. The integrity (I:H) and availability (A:H) impacts mean that successful exploitation has severe consequences. Risk context (not just CVSS) should include the sensitivity of protected data, administrative access control maturity, and recovery time objectives.

Frequently asked questions