Dell PowerProtect Data Domain OS Command Injection: Root Access Risk

The National Vulnerability Database has detailed CVE-2026-26943, an OS command injection vulnerability impacting Dell PowerProtect Data Domain versions 7.7.1.0 through 8.6, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60. This flaw carries a CVSS score of 7.2 (HIGH).

According to the National Vulnerability Database, a high-privileged attacker with remote network access could exploit this vulnerability. The outcome is arbitrary command execution, granting the attacker root privileges on the affected system. This is a critical risk, as root access on a data protection solution like PowerProtect Data Domain means complete control over backup infrastructure and potentially the data it protects.

CISOs and security teams must prioritize patching Dell PowerProtect Data Domain instances immediately. The attacker’s calculus here is straightforward: compromise a high-value target that controls sensitive backup data. Unpatched systems represent a direct path to data exfiltration, manipulation, or destruction, bypassing many traditional perimeter defenses once inside. Defenders need to ensure that administrative interfaces for such critical systems are segmented and tightly controlled, even beyond patching.