CVE-2026-26943 is an OS command injection vulnerability in Dell PowerProtect Data Domain software versions 7.7.1.0 through 8.6, including specific LTS releases. The vulnerability arises from improper neutralization of special elements used in OS commands, allowing a high privileged remote attacker to execute arbitrary commands with root-level privileges. The CVSS v3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation level has been published by Dell as of the data provided.

Successful exploitation could lead to arbitrary command execution with root privileges on affected Dell PowerProtect Data Domain systems. This could compromise system confidentiality, integrity, and availability. The vulnerability requires high privileges and remote access but does not require user interaction. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote access to affected systems to trusted administrators only and monitor for suspicious activity. Do not assume the vulnerability is mitigated without vendor confirmation.