CVE-2026-35074 Dell CVE debrief

Who should care

System administrators and security teams responsible for Dell PowerProtect Data Domain systems, especially those with high-privileged local access, should be aware of this vulnerability and take immediate action to mitigate the risk.

Technical summary

The vulnerability exists in Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60. It allows high privileged attackers with local access to execute arbitrary commands with root privileges due to improper neutralization of special elements used in an OS Command.

Defensive priority

High privileged attackers with local access could exploit this vulnerability to execute arbitrary commands with root privileges, posing a significant risk to systems using affected Dell PowerProtect Data Domain versions.

Recommended defensive actions

• Inventory affected Dell PowerProtect Data Domain systems and apply vendor-provided security updates.
• Implement compensating controls, such as restricting local access to high-privileged users.
• Monitor systems for suspicious activity and track exceptions.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges. The CVE record and NVD detail provide information on the vulnerability, including its description, CVSS score, and affected versions. A vendor advisory is available for mitigation. However, the scope of affected systems and potential impact on the organization should be carefully evaluated. Defenders should verify the accuracy of the information and assess their specific environment to determine the level of risk.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.