CVE-2026-26944 Missing authorization in PowerProtect Data Domain
Unauthenticated remote attackers can execute arbitrary commands with root privileges if an authenticated user performs a specific action.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-26944?
CVE-2026-26944 is a high-severity missing authorization vulnerability in Dell Data Domain Operating System, published on 20 Apr 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain a missing authentication for critical function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. Exploitation requires an authenticated user to perform a specific action.
Weakness: CWE-306
Which versions are affected by CVE-2026-26944?
It affects 2 products.
Products include Dell Data Domain Operating System, Dell Powerprotect Dp Series Appliance.
How do I fix CVE-2026-26944?
No fix has been published for CVE-2026-26944 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-26944 being exploited?
There is no known exploitation of CVE-2026-26944 in the wild and no public exploit code.
Other vulnerabilities in Dell Data Domain Operating System
Sources
Also known as GHSA-hmwv-mfjf-w46v.