CVE-2026-26942 is an OS command injection vulnerability in Dell PowerProtect Data Domain versions 8.5 through 8.6. This vulnerability arises from improper neutralization of special elements used in OS commands, allowing a high privileged remote attacker to execute arbitrary commands with root-level privileges. The CVSS 3.1 vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by Dell as of the publication date.

Successful exploitation could lead to arbitrary command execution with root privileges on affected Dell PowerProtect Data Domain systems, potentially compromising confidentiality, integrity, and availability of the system. However, exploitation requires high privileges and local access, limiting the attack surface. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to affected systems to trusted administrators only and monitor for suspicious activity. Avoid exposing affected versions to untrusted networks. Follow Dell's official communications for updates on patches or mitigations.