CVE-2026-24504
Published: 20 April 2026
Summary
CVE-2026-24504 is a high-severity Improper Input Validation (CWE-20) vulnerability in Dell PowerProtect Data (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-24504 is an improper input validation vulnerability (CWE-20) affecting Dell PowerProtect Data Domain storage appliances. The issue impacts versions 7.7.1.0 through 8.6, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60. Published on 2026-04-20, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.
A high-privileged attacker with remote network access can exploit this vulnerability with low complexity and no user interaction required. Successful exploitation enables arbitrary command execution with root privileges on the affected system.
Dell Security Advisory DSA-2026-060 provides details on mitigation, including a security update addressing this and multiple other vulnerabilities in PowerProtect Data Domain: https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23884
Vulnerability details
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper input validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to…
more
arbitrary command execution with root privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote improper input validation enables arbitrary root command execution on a public-facing appliance (T1190), directly facilitating privilege escalation (T1068) via Unix shell commands (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediating the specific flaw through application of Dell's security update directly eliminates the improper input validation vulnerability and prevents arbitrary root command execution.
Enforces validation of information inputs at external interfaces, directly countering the CWE-20 improper input validation exploited for command injection.
Limits high-privileged remote accounts to the least privileges necessary, reducing the attack surface for exploitation requiring PR:H access.