CVE-2026-26944 is a high-severity vulnerability in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.6, including LTS2025 and LTS2024 releases) caused by missing authentication on a critical function. This weakness could be exploited remotely by an unauthenticated attacker to execute arbitrary commands with root privileges, contingent on an authenticated user performing a specific action. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, but user interaction needed, and high impact on confidentiality, integrity, and availability. The vendor has not published an official fix or remediation level, and no known exploits have been reported.

Successful exploitation could lead to arbitrary command execution with root privileges on affected Dell PowerProtect Data Domain systems, potentially compromising system confidentiality, integrity, and availability. The vulnerability requires remote access and some user interaction but no prior authentication, increasing the risk of unauthorized control over the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor Dell's security advisories closely. Given the requirement for an authenticated user to perform a specific action, restricting access to trusted users and limiting remote access to management interfaces may reduce exposure. No vendor-provided mitigations or temporary fixes are currently documented.