CVE-2026-26944
Published: 20 April 2026
Summary
CVE-2026-26944 is a high-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Dell Data Domain Operating System. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates missing authentication for critical functions by identifying, documenting, and authorizing only necessary actions without identification or authentication.
Enforces approved access control policies requiring authentication for critical functions, preventing unauthenticated remote exploitation.
Validates inputs to critical functions to block arbitrary command execution even if authentication is bypassed.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication for critical function in Dell PowerProtect Data Domain enables unauthenticated remote attackers to achieve arbitrary root command execution, directly facilitating T1190: Exploit Public-Facing Application.
NVD Description
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain a missing authentication for critical function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading…
more
to arbitrary command execution with root privileges. Exploitation requires an authenticated user to perform a specific action.
Deeper analysisAI
CVE-2026-26944 is a missing authentication for critical function vulnerability (CWE-306) affecting Dell PowerProtect Data Domain. The issue impacts versions 7.7.1.0 through 8.6, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60. Published on 2026-04-20, it has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
An unauthenticated attacker with remote network access could potentially exploit this vulnerability to achieve arbitrary command execution with root privileges. However, successful exploitation requires an authenticated user to perform a specific action, introducing a user interaction (UI:R) requirement.
Dell's security advisory DSA-2026-060 details a security update addressing this and multiple other vulnerabilities in PowerProtect Data Domain, available at https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities.
Details
- CWE(s)