CVE-2026-49814 is an OS Command Injection vulnerability in Dell PowerProtect Data Domain affecting versions 7.7.1.0 through 8.7, LTS2026 release 8.6.1.0 through 8.6.1.10, LTS2025 release 8.3.1.0 through 8.3.1.30, and LTS2024 release 7.13.1.0 through 7.13.1.70. The vulnerability arises from improper neutralization of special elements in OS commands, allowing a high privileged remote attacker to execute arbitrary commands on the affected system. The CVSS v3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation could allow a high privileged remote attacker to execute arbitrary OS commands on the affected Dell PowerProtect Data Domain systems, potentially leading to full compromise of confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote access to trusted users with high privileges and monitor for suspicious activity related to command execution. Follow Dell's official communications for updates on patches or mitigations.