CVE-2026-86394: OS Command Injection
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
Exploitation requires a high-privileged attacker who already has remote access to the affected Dell PowerProtect Data Domain system. The provided data does not indicate that an unauthenticated or low-privileged user can exploit it.
Which release families and versions are affected?
Affected Feature Release versions are 7.7.1.0 through 8.8. Affected LTS releases are LTS2024 versions 7.13.1.0 through 7.13.1.80, LTS2025 versions 8.3.1.0 through 8.3.1.40, and LTS2026 versions 8.6.1.0 through 8.6.1.20.
What is the potential impact if exploitation succeeds?
A successful exploit could allow OS command execution. The vulnerability is rated high severity and the supplied vector indicates high confidentiality, integrity, and availability impact.