AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Dell TechnologiesCVE-2026-71171

Dell Technologies Cloud Disaster Recovery: command injection

Dell Technologies

CVE-2026-71171 · Published Aug 26, 2026 · updated Sep 3, 2026

High7.2
Fix: upgrade to CDR 20.3 or later
Dell Technologies advisory

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

Affected versions

PackageAffectedFixed in
Cloud Disaster Recovery
Product
< CDR 20.3CDR 20.3
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-78

More Dell Technologies advisories

All Dell Technologies
High 7.6Aug 26Dell Technologies Cyber Recovery: improper authenticationCVE-2026-79938fixed in Power Protect Cyber Recovery 20.3.0.0 +2Medium 5.8Aug 26Dell PowerProtect Cyber RecoveryCVE-2026-79939fixed in Power Protect Cyber Recovery 20.3.0.0 +2Medium 4.3Aug 26Dell Technologies Cloud Disaster Recovery: server-side request forgeryCVE-2026-71172fixed in CDR 20.3High 8.8Aug 26Dell Technologies PowerProtect One: command injectionCVE-2026-74770fixed in 20.3.0.0Medium 6.5Aug 26Dell Technologies PowerProtect One: tamperingCVE-2026-74771fixed in 20.3.0.0Medium 5.9Aug 26Dell Technologies PowerProtect One: improper certificate validationCVE-2026-74774fixed in 20.3.0.0