CVE-2026-23778 is a command injection vulnerability in Dell PowerProtect Data Domain's Data Domain Operating System across multiple release versions. It allows a remote attacker with high privileges to execute arbitrary commands as root due to improper neutralization of special elements in command inputs (CWE-77). The vulnerability affects Feature Release versions 7.7.1.0 through 8.5, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.50. The CVSS score of 7.2 reflects the network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could allow a high privileged remote attacker to gain root-level access on affected Dell PowerProtect Data Domain systems. This could lead to full system compromise, including unauthorized data access, modification, or disruption of service. The vulnerability impacts confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote access to trusted administrators with high privileges and monitor for suspicious activity related to command execution. Avoid exposing affected versions to untrusted networks where possible.