CVE catalog

CVE-2026-53479

Dell PowerProtect Data Domain, versions 7.7.1.0…

[CVE catalog]

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper neutralization of special elements used in an OS command ('OS command Injection') vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to protection mechanism bypass. This is a Critical vulnerability as it allows an attacker to invoke arbitrary command execution with root privileges; so Dell recommends customers to upgrade at the earliest opportunity.

Severity
High · CVSS 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.97% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
UnknownRelease not reporteddata_domain_operating_system7.13.1.80UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reporteddata_domain_operating_system8.3.1.40UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reporteddata_domain_operating_system8.6.1.20UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reporteddata_domain_operating_system8.8.0.0UnknownSource applicability is not establishedProvider not reported
Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
UnknownRelease not reporteddata_domain_operating_system7.13.1.80UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reporteddata_domain_operating_system8.3.1.40UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reporteddata_domain_operating_system8.6.1.20UnknownSource applicability is not establishedProvider not reported
UnknownRelease not reporteddata_domain_operating_system8.8.0.0UnknownSource applicability is not establishedProvider not reported
Original provider fields
{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "data_domain_operating_system",
      "fixed_version": "7.13.1.80",
      "applicability_unknown": true
    },
    {
      "name": "data_domain_operating_system",
      "fixed_version": "8.3.1.40",
      "applicability_unknown": true
    },
    {
      "name": "data_domain_operating_system",
      "fixed_version": "8.6.1.20",
      "applicability_unknown": true
    },
    {
      "name": "data_domain_operating_system",
      "fixed_version": "8.8.0.0",
      "applicability_unknown": true
    },
    {
      "name": "data_domain_operating_system",
      "ranges": [
        {
          "fixed": "8.8.0.0",
          "introduced": "8.7.0.0",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53479",
      "fixed_version": "8.8.0.0",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-53479",
      "provider_updated_at": "2026-10-25T20:10:00.147"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)]