CVE-2026-53478 is an OS command injection vulnerability in Dell PowerProtect Data Domain products. It affects versions 7.7.1.0 through 8.7, LTS2026 release 8.6.1.0 through 8.6.1.10, LTS2025 release 8.3.1.0 through 8.3.1.30, and LTS2024 release 7.13.1.0 through 7.13.1.70. The vulnerability arises from improper neutralization of special elements in OS commands, enabling a high privileged remote attacker to execute arbitrary OS commands. The CVSS 3.1 base score is 7.2, reflecting high severity with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vendor has not yet provided an official fix or remediation level. The product is not a cloud service, so remediation depends on vendor patch releases. No public exploit reports are known at this time.

Successful exploitation allows a high privileged remote attacker to execute arbitrary OS commands on the affected system, potentially leading to full compromise of confidentiality, integrity, and availability. This could result in unauthorized data access, system manipulation, or denial of service conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Dell's security advisories for updates. Until a patch is available, restrict remote access to trusted administrators with high privileges and apply principle of least privilege to limit exposure.