Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13

Successful exploitation of CVE-2026-23779 could grant an attacker root-level access to the affected Dell PowerProtect Data Domain system. This level of access provides complete control over the system, enabling the attacker to modify data, install malicious software, disrupt operations, and potentially pivot to other systems within the network. The impact is particularly severe given the Data Domain's role in data protection and backup, as an attacker could compromise sensitive data and disrupt recovery processes. The ability to gain root access mirrors the potential impact of other privilege escalation vulnerabilities, allowing for broad and unrestricted system control.

Organizations heavily reliant on Dell PowerProtect Data Domain for data protection and backup are at significant risk. This includes those with legacy deployments of affected versions, environments with inadequate access controls, and those lacking robust monitoring and patching processes. Shared hosting environments utilizing Data Domain appliances are also particularly vulnerable due to the potential for cross-tenant exploitation.

• linux / server:

journalctl -u dd-os | grep -i "command injection"

• linux / server:

ps aux | grep -i "malicious_command"

• linux / server:

find / -name "vulnerable_script.sh" -print

1. 2026-04-17Disclosure

   disclosure

1. Reservado2026-01-16
2. Publicada2026-04-17
3. Modificada2026-04-18
4. EPSS atualizado2026-04-24

The primary mitigation for CVE-2026-23779 is to upgrade Dell PowerProtect Data Domain to version 8.6.0.0 or later, as this version contains the necessary fix. If an immediate upgrade is not feasible, consider restricting local access to the Data Domain appliance to only authorized personnel. Implement strong authentication and access controls to minimize the risk of a high-privileged attacker exploiting the vulnerability. While a direct WAF rule is unlikely to be effective against this type of vulnerability, reviewing and hardening the system's configuration to minimize potential attack vectors is recommended. After upgrading, verify the fix by attempting to execute commands through vulnerable interfaces and confirming that they are properly sanitized.