CVE-2026-26943 is an OS command injection vulnerability in Dell PowerProtect Data Domain software versions 7.7.1.0 through 8.6, including LTS2025 release 8.3.1.0 through 8.3.1.20 and LTS2024 release 7.13.1.0 through 7.13.1.60. The vulnerability arises from improper neutralization of special elements used in OS commands (CWE-78). A remote attacker with high privileges could exploit this to execute arbitrary commands with root-level access on the affected system. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with high privileges and remote access to execute arbitrary OS commands as root, potentially compromising the entire system. This could lead to full system compromise, data loss, or disruption of services. However, there are currently no known exploits in the wild.

Patch status is not yet confirmed — check the Dell vendor advisory for current remediation guidance. Until an official fix is available, restrict remote access to trusted administrators only and monitor for suspicious activity involving command execution. Avoid granting unnecessary high privileges remotely.