CVE-2026-24506 is an OS command injection vulnerability in Dell PowerProtect Data Domain affecting versions 7.7.1.0 through 8.6, LTS2025 release 8.3.1.0 through 8.3.1.20, and LTS2024 release 7.13.1.0 through 7.13.1.60. The vulnerability allows a remote attacker with high privileges to execute arbitrary OS commands as root due to improper neutralization of special elements in OS commands (CWE-78). The CVSS 3.1 base score is 7.2, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by Dell as of the published date.

Successful exploitation could lead to arbitrary command execution with root privileges, compromising the confidentiality, integrity, and availability of the affected system. This could allow an attacker to fully control the device and potentially disrupt backup and data protection operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote access to high privileged accounts on affected Dell PowerProtect Data Domain systems and monitor for suspicious activity related to command execution. Follow Dell's official communications for updates on patches or mitigations.