CVE-2026-26942: dell data_domain_operating_system OS Command Injection

Vulnerability summary

CVE-2026-26942 is a high (CVSS 7.2) OS Command Injection vulnerability in dell data_domain_operating_system. EPSS estimates a 1.44% chance of exploitation in the next 30 days, higher than 72.7% of scored vulnerabilities.

Timeline

1. 20-04-2026
   PublishedVulnerability first disclosed.
2. 22-04-2026
   Last modifiedVulnerability information updated.

Description

Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS command injection vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.