Introduction
A missing authentication check in Dell PowerProtect Data Domain's operating system allows an unauthenticated remote attacker to reach a critical function and execute arbitrary commands as root, provided a legitimate user can be coaxed into performing a specific action. The vulnerability has a CVSS 3.1 base score of 8.8 and can lead to complete compromise of enterprise backup infrastructure.
Dell PowerProtect Data Domain is a purpose-built backup and deduplication storage platform. It is widely deployed in enterprise environments to protect data across on-premise and multi-cloud architectures, and organizations of all sizes build their disaster recovery strategies on it. A compromise of this system could give an attacker access to, or control over, an organization's entire backup repository.
Technical Information
Root Cause: Missing Authentication for Critical Function (CWE-306)
CVE-2026-26944 is classified under CWE-306: Missing Authentication for Critical Function. In DD OS, a network-accessible function that performs a privileged operation enforced no authentication at all, so an unauthenticated remote attacker could reach it directly over the network.
The CVSS 3.1 vector string is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Breaking this down:
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector (AV) | Network | Exploitable remotely over the network |
| Attack Complexity (AC) | Low | No special conditions or race conditions needed |
| Privileges Required (PR) | None | The attacker does not need any credentials |
| User Interaction (UI) | Required | An authenticated user must perform a specific action |
| Scope (S) | Unchanged | The vulnerability's impact stays within the vulnerable component |
| Confidentiality (C) | High | Full read access to the system |
| Integrity (I) | High | Full write/modification capability |
| Availability (A) | High | Complete denial of service possible |
Attack Flow
Based on the advisory details, exploitation works like this:
-
The attacker gets network access to the Data Domain management interface. The attacker needs no prior authentication or credentials.
-
The attacker interacts directly with the vulnerable function, which has no authentication checks at all.
-
The attacker induces a legitimate, authenticated Data Domain user to perform a specific action. This could involve social engineering, such as sending a crafted link or resource that the administrator interacts with while logged into the management interface.
-
Once the authenticated user performs that action, the attacker can execute arbitrary commands with root privileges on the Data Domain appliance.
The result is complete compromise of the system, with the attacker in full control of the confidentiality, integrity, and availability of the backup data stored on the appliance.
Related Vulnerabilities in DSA-2026-060
CVE-2026-26944 was disclosed as part of Dell Security Advisory DSA-2026-060, which addresses more than a dozen root-level vulnerabilities in the same product. Several of these are OS command injection and improper input validation flaws that all lead to privileged command execution:
| CVE ID | Vulnerability Type | CVSS Score | Privileges Required |
|---|---|---|---|
| CVE-2026-24504 | Improper input validation | 7.2 | High |
| CVE-2026-24505 | Improper input validation | 7.2 | High |
| CVE-2026-24506 | OS command injection | 7.2 | High |
| CVE-2026-26942 | OS command injection | 6.7 | High |
| CVE-2026-22761 | Command injection | 6.7 | High |
| CVE-2026-35153 | Argument injection | 6.7 | High |
| CVE-2026-35073 | OS command injection | 6.7 | High |
CVE-2026-26944 stands out from this group because it combines no required privileges with a high CVSS score of 8.8. Most of the sibling vulnerabilities require high privileges (an already-authenticated admin). CVE-2026-26944 requires user interaction from an authenticated user, but the attacker never has to authenticate.
Patch Information
Dell has addressed CVE-2026-26944 in firmware updates to the Data Domain Operating System (DD OS), released with Dell Security Advisory DSA-2026-060 on April 14, 2026. The vulnerability is in Dell's proprietary DD OS code, so no source code diff or open-source commit is publicly available. The fix ships only in official DD OS firmware packages.
The patch enforces authentication on the previously unauthenticated critical function, which closes the gap that allowed arbitrary command execution with root privileges.
Remediated Firmware Versions
| Release Track | Affected Versions | Fixed Version |
|---|---|---|
| DD OS Feature Release (8.6) | 7.7.1.0 through 8.6.0.0 | 8.6.1.10 or 8.7.0.0 or later |
| DD OS LTS2025 (8.3.1) | 8.3.1.0 through 8.3.1.20 | 8.3.1.30 or later |
| DD OS LTS2024 (7.13.1) | 7.13.1.0 through 7.13.1.60 | 7.13.1.70 or later |
| PowerProtect DP Series (IDPA) | Versions prior to 2.7.9 | 2.7.9 (ships with DD OS 8.3.1.30) |
Additional Patch Notes
DD OS version 8.6.1.10 is also the first release of Dell's new LTS 2026 long-term support branch, so organizations that adopt it get both the CVE-2026-26944 fix and an extended support lifecycle.
The affected product range is broad. It covers Dell PowerProtect Data Domain physical appliances, Data Domain Virtual Edition (DDVE), and Dell APEX Protection Storage, and all of them need the same DD OS firmware update.
Dell notes that some security scanners may still report false positive findings after an upgrade to the remediated DD OS versions. Dell has published a separate false-positive KB article for each DD OS branch (8.7, 8.6, 8.3, and 7.13) so administrators can tell real residual risk from scanner noise.
Firmware updates are available through the official Dell PowerProtect Data Domain support downloads page. Administrators should follow the standard DD OS upgrade procedures documented in Dell's knowledge base.
Affected Systems and Versions
The following Dell PowerProtect Data Domain configurations are vulnerable:
DD OS Feature Releases: Versions 7.7.1.0 through 8.6.0.0
DD OS LTS2025 Release: Versions 8.3.1.0 through 8.3.1.20
DD OS LTS2024 Release: Versions 7.13.1.0 through 7.13.1.60
PowerProtect DP Series (IDPA): Versions prior to 2.7.9
The vulnerability affects all form factors running these DD OS versions: physical Data Domain appliances, Data Domain Virtual Edition (DDVE), and Dell APEX Protection Storage.
Vendor Security History
DSA-2026-060 addresses more than a dozen vulnerabilities at once, and many of them allow root-level command execution. Flaws from several vulnerability classes (missing authentication, OS command injection, improper input validation, argument injection) in a single product release suggest a broad attack surface in the DD OS management layer. Dell chose to handle all of them in one coordinated advisory, which also includes fixes for third-party components like Apache Commons FileUpload and OpenSSL, and that indicates a thorough security review of the product. Dell has stated that there is no indication of active exploitation for any of the disclosed vulnerabilities.
References
- DSA-2026-060: Security Update for Dell PowerProtect Data Domain Multiple Vulnerabilities
- NVD Entry for CVE-2026-26944
- CVE Record: CVE-2026-26944
- Heise: Numerous attacks on Dell PowerProtect Data Domain possible
- CISA Known Exploited Vulnerabilities Catalog
- Dell PowerProtect Data Domain Support Downloads
- Feedly CVE-2026-26944 Tracking
