What is the CVSS score of CVE-2026-35070?

CVE-2026-35070 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35070?

Yes, a patch is available for CVE-2026-35070. Update the affected software to the latest version immediately.

Dell SmartFabric Storage Software CVE-2026-35070

EUVD-2026-31086 MEDIUM

Command Injection (CWE-77)

2026-05-20 security_alert@emc.com

GHSA-7rmc-4wcf-hgwm

Command Injection Dell Smartfabric Storage Software

6.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 24, 2026 - 10:22 NVD

6.4 (MEDIUM) 6.7 (MEDIUM)

Patch available

May 20, 2026 - 11:02 EUVD

Analysis Generated

May 20, 2026 - 10:33 vuln.today

DescriptionNVD

Dell SmartFabric Storage Software, versions prior to 1.4.5, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.

AnalysisAI

Command injection in Dell SmartFabric Storage Software versions prior to 1.4.5 enables a high-privileged local attacker to gain unauthorized read and write access to the underlying filesystem. Exploitation requires local system presence and high-level privileges, with the CVSS vector (AV:L/AC:H/PR:H) indicating a constrained threat surface despite the high confidentiality, integrity, and availability impact scores. No public exploit identified at time of analysis, and this vulnerability is not listed in CISA KEV.

Technical ContextAI

CWE-77 (Improper Neutralization of Special Elements used in a Command) describes a class of vulnerabilities where user-controlled input is concatenated into a system command without sufficient sanitization, allowing shell metacharacters or command separators to redirect execution flow. In Dell SmartFabric Storage Software - a software-defined networking and storage fabric management platform - one or more administrative interfaces or internal command-processing routines fail to sanitize input before passing it to an underlying OS or shell command, enabling injection of attacker-supplied commands. The affected CPE resolves to Dell SmartFabric Storage Software versions below 1.4.5, as confirmed by vendor advisory DSA-2026-235.

RemediationAI

Upgrade Dell SmartFabric Storage Software to version 1.4.5 or later, as specified in Dell Security Advisory DSA-2026-235 available at https://www.dell.com/support/kbdoc/en-us/000466942/dsa-2026-235-security-update-for-dell-networking-smartfabric-storage-software-vulnerabilities. If immediate patching is not feasible, restrict local and remote administrative access to the SmartFabric management plane to the minimum required personnel, enforce multi-factor authentication for privileged accounts, and audit all high-privilege session activity for anomalous command execution. Note that restricting access reduces exposure but does not eliminate the vulnerability, as the flaw is exercisable by any legitimately high-privileged user.