Brief Summary: Dell PowerProtect Data Domain CVE-2026-26943 OS Command Injection Leading to Root Execution

Introduction

A root-level OS command injection in Dell PowerProtect Data Domain means that any attacker who already has high-privilege administrative access to the appliance can escalate to full root command execution remotely, with no user interaction required. For organizations that rely on Data Domain as the backbone of their backup and disaster recovery strategy, this vulnerability puts the last line of defense against ransomware and data loss directly at risk.

Dell PowerProtect Data Domain is a widely deployed enterprise backup and deduplication storage platform. It is a core component of backup, archive, and disaster recovery operations across large enterprises. The platform includes physical appliances, virtual editions, and cloud-integrated offerings such as Dell APEX Protection Storage. Its role in ransomware recovery workflows makes it a particularly sensitive target in any enterprise environment.

Technical Information

CVE-2026-26943 is classified under CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). The root cause is insufficient sanitization of input that is eventually passed to an operating system command execution context within the Data Domain OS. Dell has not disclosed the specific input surface or API endpoint involved, but the CVSS vector string says a great deal about the flaw.

The full CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, for a base score of 7.2. Metric by metric:

• Attack Vector (Network): This matches how Data Domain's management interfaces are typically exposed, over SSH, REST APIs, or web-based administration consoles.
• Attack Complexity (Low): Exploitation needs no special conditions, race windows, or non-default configurations. Once the attacker has the right access, it is straightforward.
• Privileges Required (High): The attacker must hold high-level administrative credentials on the Data Domain system. This is the primary barrier to exploitation.
• User Interaction (None): No legitimate user has to click a link or take any action.
• Scope (Unchanged): The impact stays within the vulnerable component. Because that component is the entire Data Domain OS, this still means full system compromise.
• Impact (High across all three dimensions): Successful exploitation grants arbitrary command execution as root, which means complete control over the appliance's data, configuration, and availability.

Chaining Risk with CVE-2026-26944

The same Dell advisory, DSA-2026-060, also addresses CVE-2026-26944, a missing authentication for critical function vulnerability scored at CVSS 8.8. It requires no authentication but does require user interaction. The two compare as follows:

An attacker could use CVE-2026-26944 to get around the high-privilege requirement of CVE-2026-26943. If an unauthenticated attacker can trick an authenticated administrator into performing a specific action (for example, visiting a crafted URL or interacting with a malicious request), they could use the missing authentication flaw to gain the foothold the command injection needs. Defenders should treat the two as one combined threat rather than evaluating each in isolation.

Attack Flow

From the available technical details, a plausible exploitation flow looks like this:

1. The attacker identifies a network-reachable Dell PowerProtect Data Domain management interface.
2. Using compromised or otherwise obtained high-privilege administrative credentials, the attacker authenticates to the management interface.
3. The attacker submits crafted input containing OS command injection payloads through the vulnerable input surface.
4. Because the input is not sufficiently sanitized, the system passes the injected commands to an OS-level execution context.
5. The commands execute with root privileges on the underlying Data Domain OS, giving the attacker full control over the appliance.

An attacker chaining CVE-2026-26944 could instead bypass the authentication requirement entirely, exploiting the missing authentication flaw first and then pivoting to the command injection.

Affected Systems and Versions

The vulnerability affects these Dell PowerProtect Data Domain release tracks and version ranges:

• DD OS Mainline: versions 7.7.1.0 through 8.6
• DD OS LTS2025: versions 8.3.1.0 through 8.3.1.20
• DD OS LTS2024: versions 7.13.1.0 through 7.13.1.60
• Data Domain Management Center: versions before 2.7.9 with DD OS 8.3.1.30

Affected product families include:

• Dell PowerProtect Data Domain series appliances
• Data Domain Virtual Edition
• Dell APEX Protection Storage
• Data Domain Management Center

The remediated versions are:

References

• NVD: CVE-2026-26943
• CVE Record: CVE-2026-26943
• DSA-2026-060: Security Update for Dell PowerProtect Data Domain Multiple Vulnerabilities
• PowerProtect Data Domain All Flash Ready Node
• PowerProtect Data Manager: Data Protection Software