Dell PowerProtect Data Domain: Root OS Command Injection

The National Vulnerability Database has disclosed CVE-2026-24506, an OS command injection flaw impacting Dell PowerProtect Data Domain versions 7.7.1.0 through 8.6, including LTS2025 release versions 8.3.1.0 through 8.3.1.20 and LTS2024 release versions 7.13.1.0 through 7.13.1.60. This vulnerability carries a high CVSS score of 7.2.

An attacker with high privileges and remote network access could exploit this flaw to execute arbitrary commands as the root user. This is a critical issue for data backup and recovery infrastructure, as compromise of a Data Domain system could lead to complete data loss, manipulation, or exfiltration, directly impacting business continuity and integrity.

Defenders must prioritize patching these systems immediately. Given the high privileges required, the attacker’s calculus here is likely post-exploitation. This means an adversary has already gained a foothold and is looking to escalate privileges to root for maximum control and persistence within the data center environment. Don’t assume your network perimeter will save you from this one; focus on internal segmentation and least privilege for administrative accounts.