Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13

Successful exploitation of CVE-2026-23778 could grant an attacker complete control over the affected Dell PowerProtect Data Domain system. This includes the ability to read, modify, and delete data, install malicious software, and potentially pivot to other systems on the network. Given the critical nature of Data Domain appliances in data protection and recovery, a compromise could lead to significant data loss, business disruption, and reputational damage. The ability to gain root access bypasses standard security controls, making it a particularly dangerous vulnerability. The potential for lateral movement from the compromised Data Domain appliance to other systems within the network significantly expands the blast radius of a successful attack.

Organizations heavily reliant on Dell PowerProtect Data Domain for data backup and recovery are particularly at risk. This includes those with legacy configurations or those who have not implemented robust access controls. Shared hosting environments utilizing Data Domain appliances are also vulnerable, as a compromise of one tenant could potentially impact others.

• linux / server:

journalctl -u dd-os -g 'command injection'

• linux / server:

ps aux | grep -i 'malicious_command'

• linux / server:

find / -perm -4000 -type f -print

• linux / server:

ssh -i /tmp/id_rsa root@<data_domain_ip> 'whoami'

1. 2026-04-17Disclosure

   disclosure

1. Réservé2026-01-16
2. Publiée2026-04-17
3. Modifiée2026-04-18
4. EPSS mis à jour2026-04-24

The primary mitigation for CVE-2026-23778 is to upgrade Dell PowerProtect Data Domain to version 8.6.0.0 or later, as this release contains the necessary fix. If immediate upgrading is not feasible, consider implementing network segmentation to limit the potential impact of a successful exploit. Restrict access to the Data Domain appliance to only authorized personnel and enforce strong authentication mechanisms. Monitor system logs for suspicious activity, particularly commands executed by privileged users. While a WAF or proxy cannot directly prevent command injection, it can be configured to detect and block known malicious patterns. There are no specific Sigma or YARA rules available at this time, but monitoring for unusual process executions and file modifications is recommended.