CVE-2026-71171
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk60th percentile - higher than 60% of all known CVEs
Summary
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
Risk Assessment
The risk includes the possibility of remote code execution by a privileged attacker, which could lead to full system and data compromise.
Recommendation
Upgrade Dell Cloud Disaster Recovery to the latest patched version and restrict REST API access to trusted users only.
Other vulnerabilities in Dell Cloud Disaster Recovery
See all- CVE-2026-70419Critical
Dell Cloud Disaster Recovery versions 20.2 and prior contain an OS Command Injection vulnerability. A high privileged attacker with remote access could exploit this to execute commands.
- CVE-2026-71172Medium
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
Original NVD description (English source)
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.