CVE-2026-23774 is an OS command injection vulnerability (CWE-78) in Dell PowerProtect Data Domain's Data Domain Operating System versions 7.7.1.0 through 8.5, including specified LTS releases. A remote attacker with high privileges could exploit this vulnerability to execute arbitrary OS commands, potentially compromising confidentiality, integrity, and availability of the system. The vulnerability is rated high severity with a CVSS 3.1 base score of 7.2 (Network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability). No vendor advisory or patch information is currently available.

Successful exploitation could allow a high privileged remote attacker to execute arbitrary commands on the affected Dell PowerProtect Data Domain system, leading to full compromise of system confidentiality, integrity, and availability. This could result in unauthorized data access, modification, or disruption of backup and data protection services.

Patch status is not yet confirmed — check the Dell vendor advisory for current remediation guidance. Until an official fix is released, limit remote access to trusted administrators with high privileges and monitor for suspicious activity related to command execution. Avoid exposing affected versions to untrusted networks.