Cyber Posture

CVE-2026-26944

High

Published: 20 April 2026

Published
20 April 2026
Modified
23 April 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0017 38.1th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain a missing authentication for critical function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading…

more

to arbitrary command execution with root privileges. Exploitation requires an authenticated user to perform a specific action.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates missing authentication for critical functions by identifying, documenting, and authorizing only necessary actions without identification or authentication.

prevent

Enforces approved access control policies requiring authentication for critical functions, preventing unauthenticated remote exploitation.

prevent

Validates inputs to critical functions to block arbitrary command execution even if authentication is bypassed.

Security SummaryAI

CVE-2026-26944 is a missing authentication for critical function vulnerability (CWE-306) affecting Dell PowerProtect Data Domain. The issue impacts versions 7.7.1.0 through 8.6, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60. Published on 2026-04-20, it has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

An unauthenticated attacker with remote network access could potentially exploit this vulnerability to achieve arbitrary command execution with root privileges. However, successful exploitation requires an authenticated user to perform a specific action, introducing a user interaction (UI:R) requirement.

Dell's security advisory DSA-2026-060 details a security update addressing this and multiple other vulnerabilities in PowerProtect Data Domain, available at https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities.

Details

CWE(s)

Affected Products

dell
powerprotect dp series appliance
≤ 2.7.9
dell
data domain operating system
7.7.1.0 — 7.13.1.70 · 7.14.0.0 — 8.3.1.30 · 8.4.0.0 — 8.6.1.0

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Missing authentication for critical function in Dell PowerProtect Data Domain enables unauthenticated remote attackers to achieve arbitrary root command execution, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References