CVE-2026-23778 is a command injection vulnerability in Dell PowerProtect Data Domain's Data Domain Operating System across multiple versions. It allows an attacker with high privileges and remote access to execute arbitrary commands as root, potentially compromising confidentiality, integrity, and availability of the system. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS score of 7.2 reflects a network attack vector with low attack complexity, requiring high privileges but no user interaction, and resulting in high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by Dell as of the publication date.

Successful exploitation could lead to full root-level compromise of affected Dell PowerProtect Data Domain systems, allowing an attacker to execute arbitrary commands remotely. This impacts system confidentiality, integrity, and availability. However, exploitation requires high privileges and remote access. There are no known exploits reported in the wild at this time.

Patch status is not yet confirmed — check the Dell vendor advisory for current remediation guidance. Until an official fix is available, restrict remote access to trusted administrators with high privileges and monitor for suspicious activity. Avoid exposing affected versions to untrusted networks. Follow Dell's official communications for updates on patches or mitigations.