CVE-2026-26355 Dell CVE debrief

Who should care

Administrators and security teams responsible for Dell PowerProtect Data Domain systems should prioritize patching this vulnerability to prevent potential command execution attacks. Additionally, security teams should review compensating controls for exposed systems while remediation is scheduled and verified, and monitor system logs for suspicious activity.

Technical summary

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70, contain an improper neutralization of special elements used in an OS command ('OS command injection') vulnerability. A high-privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution. The vulnerability is caused by insufficient validation of user input, allowing an attacker to inject malicious commands.

Defensive priority

High

Recommended defensive actions

• Apply patches or updates provided by Dell to vulnerable systems
• Restrict remote access to high-privileged accounts
• Monitor system logs for suspicious activity
• Implement additional security controls, such as network segmentation and access controls
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-03T13:17:02.320Z and was last modified on 2026-07-07T05:16:50.403Z. The NVD entry is currently Awaiting Analysis. Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 are affected. However, detailed information about the vulnerability and affected configurations is limited in the CVE and NVD entries provided.

Official resources