CVE-2026-35072 — Vulnetix

CVE-2026-35072 PUBLISHED CVSS 6.699999809265137 MEDIUM

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command ('OS command injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

Risk Scores

CVSS v3.1

6.699999809265137

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Dell	PowerProtect Data Domain	0, 0, 0

Timeline

Apr 17, 2026 CVE Published
Apr 17, 2026 PoC Published
Apr 18, 2026 Security Advisory
Apr 18, 2026 CVE Updated

References

https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities vendor-advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-35072 advisory

Open in Interactive Console →