CVE-2026-71171

HighCVSS 7.2/10Last modified Sep 3, 2026

Description

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Aug 26, 2026
Last modified: Sep 3, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-711724.3Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker CVE-2026-711768.8Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL In CVE-2026-711775.4Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Rendered UI Layers or Fr CVE-2026-711783.7Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization CVE-2026-711797.8Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command ('O CVE-2026-71186.3A security vulnerability has been detected in code-projects Employee Management System 1.0. The affected element is an unknown function of t CVE-2026-711807.8Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with CVE-2026-711816.0Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulner CVE-2026-711826.0Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulner CVE-2026-711837.1An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not a CVE-2026-711848.8Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does n CVE-2026-711879.8The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid