CVE-2026-26354 is a stack-based buffer overflow vulnerability in Dell PowerProtect Data Domain's Domain Operating System (DD OS) across multiple feature release and LTS versions. The vulnerability allows an unauthenticated remote attacker to potentially execute arbitrary commands due to improper handling of input leading to a buffer overflow condition. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required. No patch or official remediation level has been disclosed by Dell as of the publication date.

Successful exploitation could lead to arbitrary command execution on affected Dell PowerProtect Data Domain systems, compromising confidentiality, integrity, and availability. The attacker does not require authentication but must have remote network access. This could allow full system compromise or disruption of backup and data protection services.

Patch status is not yet confirmed — check the Dell vendor advisory for current remediation guidance. Until an official fix is available, restrict remote network access to affected systems and monitor for unusual activity. Avoid exposing the affected versions to untrusted networks.