Critical Dell PowerProtect Vulnerability Allows Root Command Execution

The National Vulnerability Database has identified CVE-2026-26944, a critical vulnerability affecting Dell PowerProtect Data Domain. Versions 7.7.1.0 through 8.6, LTS2025 release 8.3.1.0 through 8.3.1.20, and LTS2024 release 7.13.1.0 through 7.13.1.60 are impacted by a missing authentication flaw in a critical function.

This vulnerability, rated HIGH with a CVSS score of 8.8, allows an unauthenticated remote attacker to achieve arbitrary command execution with root privileges. While exploitation requires an authenticated user to perform a specific action, the potential for privilege escalation is severe. Attackers could leverage this to gain full control of the backup infrastructure, potentially exfiltrating sensitive data or disrupting recovery operations.

Defenders must prioritize patching affected Dell PowerProtect Data Domain systems immediately. Organizations should also review access controls and audit logs for any suspicious activity, especially around critical functions that require authentication. This is not a vulnerability to ignore given the direct path to root access.