CVE-2026-26944
Published: 20 April 2026
Description
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain a missing authentication for critical function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading…
more
to arbitrary command execution with root privileges. Exploitation requires an authenticated user to perform a specific action.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates missing authentication for critical functions by identifying, documenting, and authorizing only necessary actions without identification or authentication.
Enforces approved access control policies requiring authentication for critical functions, preventing unauthenticated remote exploitation.
Validates inputs to critical functions to block arbitrary command execution even if authentication is bypassed.
Security SummaryAI
CVE-2026-26944 is a missing authentication for critical function vulnerability (CWE-306) affecting Dell PowerProtect Data Domain. The issue impacts versions 7.7.1.0 through 8.6, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60. Published on 2026-04-20, it has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
An unauthenticated attacker with remote network access could potentially exploit this vulnerability to achieve arbitrary command execution with root privileges. However, successful exploitation requires an authenticated user to perform a specific action, introducing a user interaction (UI:R) requirement.
Dell's security advisory DSA-2026-060 details a security update addressing this and multiple other vulnerabilities in PowerProtect Data Domain, available at https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication for critical function in Dell PowerProtect Data Domain enables unauthenticated remote attackers to achieve arbitrary root command execution, directly facilitating T1190: Exploit Public-Facing Application.