CVE-2026-23779
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
Dell PowerProtect Data Domain with DD OS in Feature Release versions 7.7.1.0 through 8.5, LTS2025 8.3.1.0 through 8.3.1.20, and LTS2024 7.13.1.0 through 7.13.1.50 contains a command injection vulnerability. A high-privileged attacker with local access could exploit it to gain root-level access.
Risk Assessment
This could allow a locally privileged attacker to gain full control over the backup system and its data.
Recommendation
Update DD OS to a fixed version and restrict local access to authorized administrators.
Other vulnerabilities in Dell PowerProtect Data Domain DD OS
See all- CVE-2026-28263Medium
Dell PowerProtect Data Domain with DD OS contains a cross-site scripting vulnerability. A high-privileged attacker with remote access could exploit it to inject scripts.
- CVE-2026-23777Medium
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) in Feature Release versions 7.7.1.0 through 8.5, LTS2025 8.3.1.0 through 8.3.1.20, and LTS2024 7.13.1.0 through 7.13.1.50 contains an exposure of sensitive information to an unauthorized actor vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
- CVE-2025-43727High
Dell PowerProtect Data Domain with DD OS contains an incorrect implementation of an authentication algorithm in the RestAPI. This affects Feature Release 7.7.1.0 through 8.1.0.10, LTS2024 7.13.1.0 through 7.13.1.25, and LTS 2023 7.10.1.0 through 7.10.1.50. An unauthenticated remote attacker could potentially exploit this to gain unauthorized access.
Original NVD description (English source)
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability to gain root-level access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS