CVE-2026-86396: OS Command Injection
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs remote access to the affected Dell PowerProtect Data Domain system and low-privileged access. No user interaction is required.
What is the potential impact of successful exploitation?
Successful exploitation could allow OS command execution and may affect confidentiality, integrity, and availability.
Which release families are affected?
Affected versions include Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20.