CVE-2026-24504

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper input validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Apr 20, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-245057.2Dell PowerProtect Data Domain, versions 8.5 through 8.6 contain an improper input validation vulnerability. A high privileged attacker with CVE-2026-245067.2Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13CVE-2026-245085.5Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Certificate Validation vulnerability. A low privilegeCVE-2026-245095.5Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Access Control vulnerability. A low privileged attackCVE-2026-24516.5Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email templatCVE-2026-245107.8Dell Alienware Command Center (AWCC), versions prior to 6.12.24.0, contain an Improper Privilege Management vulnerability. A low privileged CVE-2026-245114.4Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.6 and versions 9.11.0.0 through 9.13.0.0, contains a generation of error message contCVE-2026-245128.8A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into ngCVE-2026-245133.1A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may not be effective in CVE-2026-245146.5A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service conditiCVE-2026-245152.5In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.CVE-2026-245168.8A command injection vulnerability exists in DigitalOcean Droplet Agent through 1.3.2. The troubleshooting actioner component (internal/troub