CVE-2026-21418

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21418", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2025-12-24T16:33:47.094Z", "datePublished": "2026-01-30T08:38:59.870Z", "dateUpdated": "2026-02-26T15:04:42.636Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Unity", "vendor": "Dell", "versions": [{"lessThan": "5.5.3", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "datePublic": "2026-01-28T18:30:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Dell Unity, version(s) 5.5.2 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.<br>"}], "value": "Dell Unity, version(s) 5.5.2 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-01-30T08:38:59.870Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000421197/dsa-2026-054-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21418", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-31T04:56:20.547008Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:42.636Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21418", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-30T12:59:32.268806Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-30T13:00:04.347Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "Unity", "versions": [{"status": "affected", "version": "N/A", "lessThan": "5.5.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-01-28T18:30:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000421197/dsa-2026-054-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Dell Unity, version(s) 5.5.2 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.", "supportingMedia": [{"type": "text/html", "value": "Dell Unity, version(s) 5.5.2 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-01-30T08:38:59.870Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21418", "state": "PUBLISHED", "dateUpdated": "2026-01-31T04:56:19.746Z", "dateReserved": "2025-12-24T16:33:47.094Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2026-01-30T08:38:59.870Z", "assignerShortName": "dell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Unity", "vendor": "Dell", "versions": [{"lessThan": "5.5.3", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:unity_operating_environment:*:*:*:*:*:*:*:*", "matchCriteriaId": "ED4C4D95-DC2F-47F0-AC47-25C0418E601C", "versionEndExcluding": "5.5.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell Unity, version(s) 5.5.2 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges."}, {"lang": "es", "value": "Dell Unity, versi\u00f3n(es) 5.5.2 y anteriores, contiene una vulnerabilidad de Neutralizaci\u00f3n Incorrecta de Elementos Especiales utilizados en un Comando de SO (inyecci\u00f3n de comandos de SO). Un atacante con pocos privilegios y acceso local podr\u00eda potencialmente explotar esta vulnerabilidad, lo que llevar\u00eda a la ejecuci\u00f3n arbitraria de comandos con privilegios de root."}], "id": "CVE-2026-21418", "lastModified": "2026-06-17T10:18:38.047", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security_alert@emc.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21418", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-31T04:56:20.547008Z", "version": "2.0.3"}}]}, "published": "2026-01-30T09:15:50.920", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000421197/dsa-2026-054-security-update-for-dell-unity-dell-unityvsa-and-dell-unity-xt-security-update-for-multiple-vulnerabilities"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:12:14.359029+00:00", "value": {"mitigation_remediation": ["Apply the Dell security update DSA-2026-054 that addresses the OS command injection in Unity 5.5.2 and earlier.", "Revoke or restrict local administrative privileges for users not required to perform Unity maintenance, effectively limiting the attacker's ability to trigger the injection.", "Continuously monitor system logs for anomalous command execution patterns and verify that the Unity software has been updated across all managed devices."], "summary": {"action": "Immediate Patch", "impact": "Command Execution and Privilege Escalation"}, "threat_synthesis": {"affected_systems": "Dell Unity Operating Environment version 5.5.2 and all versions prior to 5.5.2 are affected. The vulnerability applies to the Unity core software that runs within the Unity Storage Appliance.", "description_and_impact": "The vulnerability is an OS command injection (CWE-78) that permits a low-privileged local attacker to execute arbitrary commands with root privileges on Dell Unity 5.5.2 and earlier. This flaw enables full control over the affected system, potentially compromising the confidentiality, integrity, and availability of all data stored on the device.", "risk_and_exploitability": "The CVSS score of 7.8 indicates a high impact vulnerability, but the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. Exploit requires local access from a low-privileged user, and the vulnerability is not listed in the CISA KEV catalog. If an attacker gains local access, the problem can be leveraged for full root-level command execution, making it a critical local privilege escalation risk."}}}}, "created": "2026-02-02T09:27:53.585208+00:00", "title": "OS Command Injection in Dell Unity Operating Environment", "updated": "2026-04-18T01:15:05.993676+00:00", "vendors": ["dell", "dell$PRODUCT$unity"]}