Dell PowerProtect Data Domain Vulnerable to OS Command Injection

The National Vulnerability Database has identified CVE-2026-23774, a critical OS command injection flaw affecting Dell PowerProtect Data Domain systems running specific versions of Data Domain Operating System (DD OS). Versions ranging from 7.7.1.0 through 8.5, along with certain LTS releases (8.3.1.0-8.3.1.10, 7.13.1.0-7.13.1.40), are susceptible. This vulnerability, with a CVSS score of 7.2, allows a highly privileged attacker with remote access to execute arbitrary commands on the system.

Attackers exploiting this vulnerability could gain significant control over the affected data protection infrastructure. The implications are severe, potentially leading to data exfiltration, system disruption, or further lateral movement within an organization’s network. The CWE-78 designation highlights the direct nature of the command injection, bypassing intended system operations.

Defenders must prioritize patching these vulnerable Dell PowerProtect Data Domain systems immediately. Given the high privilege requirement and remote access vector, organizations should also review access controls and network segmentation around these critical backup appliances. Any anomalous activity or unauthorized command execution logs on these systems warrant immediate investigation.