CVE-2026-86395: OS Command Injection
Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires a high-privileged attacker with remote access to an affected Dell PowerProtect Data Domain Virtual Edition deployment. The provided information does not indicate that unauthenticated or low-privileged users can exploit it.
What is the likely impact if exploitation succeeds?
A successful exploit could lead to command execution. The supplied severity vector rates confidentiality, integrity, and availability impacts as high.
Which release trains are affected?
Affected releases include Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20.