CVE-2026-24506 is an OS command injection vulnerability in Dell PowerProtect Data Domain affecting versions 7.7.1.0 through 8.6 and LTS2025/2024 releases within specified version ranges. The vulnerability arises from improper neutralization of special elements used in OS commands (CWE-78). A remote attacker with high privileges could exploit this to execute arbitrary commands with root privileges. The CVSS 3.1 score of 7.2 reflects network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows a high privileged remote attacker to execute arbitrary OS commands as root, potentially compromising system confidentiality, integrity, and availability. This could lead to full system compromise of affected Dell PowerProtect Data Domain devices.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote access to trusted administrators only and monitor for suspicious activity involving command execution. Avoid exposing vulnerable versions to untrusted networks.