CVE-2026-23778
Command Injection in Dell PowerProtect DD OS Enables Root Access
Publication date: 2026-04-17
Last updated on: 2026-04-20
Assigner: Dell
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dell | powerprotect_dp_series_appliance | to 2.7.9 (exc) |
| dell | data_domain_operating_system | From 7.7.1.0 (inc) to 7.13.1.50 (exc) |
| dell | data_domain_operating_system | From 8.4.0.0 (inc) to 8.6.0.0 (exc) |
| dell | data_domain_operating_system | From 7.14.0.0 (inc) to 8.3.1.20 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions from 7.7.1.0 through 8.5, including certain LTS2025 and LTS2024 release versions. It is a command injection vulnerability that allows a highly privileged attacker with remote access to potentially execute arbitrary commands on the system.
Exploiting this vulnerability could enable the attacker to gain root-level access, which means full control over the affected system.
How can this vulnerability impact me? :
If exploited, this vulnerability can have severe impacts including unauthorized root-level access to the affected system.
- An attacker could execute arbitrary commands with high privileges.
- Confidentiality, integrity, and availability of data stored or processed by the system could be compromised.
- Potential disruption of services or data loss due to malicious actions.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a high privileged attacker with remote access to potentially gain root-level access to affected Dell PowerProtect Data Domain systems.
Such unauthorized root-level access could lead to compromise of sensitive data, impacting the confidentiality, integrity, and availability of information stored or processed by these systems.
Consequently, exploitation of this vulnerability may result in non-compliance with data protection standards and regulations such as GDPR and HIPAA, which require strict controls to protect sensitive personal and health information.