CVE-2026-22277CWE-78

Dell UnityVSA, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability

High · published January 30, 2026

CVSS v3.1
7.8
EPSS
1%
Percentile
51.0
In the wild
Unconfirmed
What it is

⚡ An improper handling of special elements could let a low-privileged attacker execute commands with root privileges! 🎉 Think of it like an unsuspecting hotel guest who finds a hidden door that allows them to access the entire building's control room — with just a simple passcode. Anyone with local access could exploit this flaw to take complete control, leading to chaos! If exploited, this vulnerability could allow an attacker to run any command on the system as if they were the admin, potentially resulting in data breaches, system degradation, or severe disruption of services. It's a serious risk that could compromise the integrity and availability of your systems!

Put simply

Think of it like an unsuspecting hotel guest who finds a hidden door that allows them to access the entire building's control room — with just a simple passcode. Anyone with local access could exploit this flaw to take complete control, leading to chaos! This OS Command Injection vulnerability in Dell UnityVSA allows an attacker with local access to improperly execute commands, bypassing intended restrictions and gaining root access to the system. Affected versions include 5.4 and prior.

What to do

If exploited, this vulnerability could allow an attacker to run any command on the system as if they were the admin, potentially resulting in data breaches, system degradation, or severe disruption of services. It's a serious risk that could compromise the integrity and availability of your systems! Immediate action is essential! Patch to version 5.4.1 or later to address this vulnerability. Additionally, review access controls to limit local access to only trusted users. Regular audits can help maintain a secure environment. You've got this! By patching and tightening access controls, you're on the path to safeguarding your systems. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00661 · 51.0th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-01-30T08:27Z
EPSS history
Timeline
  • 30 JAN 08:27Z
    Dell UnityVSA, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability
    cvelistv5