CVE-2026-24504
Improper Input Validation in Dell PowerProtect Enables Root RCE
Publication date: 2026-04-20
Last updated on: 2026-04-28
Assigner: Dell
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dell | powerprotect_dp_series_appliance | to 2.7.9 (exc) |
| dell | data_domain_operating_system | From 7.14.0.0 (inc) to 8.3.1.30 (exc) |
| dell | data_domain_operating_system | From 7.7.1.0 (inc) to 7.13.1.70 (exc) |
| dell | data_domain_operating_system | From 8.4.0.0 (inc) to 8.6.1.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Dell PowerProtect Data Domain versions 7.7.1.0 through 8.6, including certain LTS2025 and LTS2024 release versions. It is caused by improper input validation, which means the system does not correctly check or sanitize input data.
A highly privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system with root privileges, which is the highest level of access.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to an attacker gaining root-level control over the affected system remotely.
- Arbitrary command execution with full system privileges.
- Potential compromise of system integrity, confidentiality, and availability.
- Possible unauthorized access to sensitive data or disruption of services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows a high privileged attacker with remote access to execute arbitrary commands with root privileges on affected Dell PowerProtect Data Domain versions.
Such unauthorized root-level access and potential data compromise could lead to violations of common standards and regulations like GDPR and HIPAA, which require strict controls on data confidentiality, integrity, and access.
However, specific impacts on compliance are not detailed in the provided information.