Dell PowerProtect Data Domain versions 8.5 through 8.6 contain an OS command injection vulnerability (CWE-78) due to improper neutralization of special elements in OS commands. This flaw could be exploited by a high privileged remote attacker to execute arbitrary commands with root privileges, potentially compromising system integrity and confidentiality. The CVSS 3.1 base score is 6.7, reflecting medium severity with local attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by Dell as of the publication date.

Successful exploitation allows arbitrary command execution with root privileges by a high privileged attacker with remote access, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote access to trusted users with high privileges and monitor for suspicious activity related to command execution. Avoid exposing vulnerable versions externally where possible.