What is the CVSS score of CVE-2026-35072?

CVE-2026-35072 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35072?

Yes, a patch is available for CVE-2026-35072. Update the affected software to the latest version immediately.

Powerprotect Data Domain CVE-2026-35072

EUVD-2026-23405 MEDIUM

OS Command Injection (CWE-78)

2026-04-17 dell

GHSA-53vq-962v-f9cq

Command Injection Dell Powerprotect Data Domain

6.7

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (dell) · only source for this CVE.

CVSS VectorVendor: dell

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 17, 2026 - 15:07 nvd

Patch available

Apr 17, 2026 - 12:01 EUVD

Analysis Generated

Apr 17, 2026 - 11:26 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 11:15 euvd

EUVD-2026-23405

Analysis Generated

Apr 17, 2026 - 11:15 vuln.today

CVE Published

Apr 17, 2026 - 10:48 nvd

MEDIUM 6.7

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command ('OS command injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

AnalysisAI

Dell PowerProtect Data Domain versions 7.7.1.0-8.7.0.0, LTS2025 8.3.1.0-8.3.1.20, and LTS2024 7.13.1.0-7.13.1.60 allow OS command injection via improper neutralization of special elements in OS commands. A high-privileged local attacker can execute arbitrary commands with root privileges by exploiting this vulnerability, enabling complete system compromise.

Technical ContextAI

The vulnerability exists in Dell PowerProtect Data Domain, a data deduplication and backup appliance that processes command-line inputs. The root cause is CWE-78 (OS Command Injection), which occurs when user-supplied or attacker-controlled data is passed unsanitized to system command execution functions without proper input validation or escaping. PowerProtect Data Domain likely constructs OS commands dynamically using unsanitized variables, allowing attackers with high privileges to inject metacharacters (such as semicolons, pipes, or backticks) to execute arbitrary shell commands. The vulnerability affects multiple release branches, including the main release line (7.7.1.0-8.7.0.0) and long-term support (LTS) branches, suggesting the flaw exists in shared code across all supported versions.

RemediationAI

Install the security update provided in Dell advisory DSA-2026-060. For main release versions, upgrade to a patched release at or above the version specified in the advisory. For LTS2025 branch, upgrade to 8.3.1.21 or later; for LTS2024 branch, upgrade to 7.13.1.61 or later. Before applying patches, test in a non-production environment to verify compatibility with your backup workflows. If immediate patching is not feasible, restrict administrative access to PowerProtect Data Domain appliances by limiting shell access to only necessary administrators, implementing multi-factor authentication for administrator accounts, and monitoring privileged command execution logs for suspicious activity. However, these compensating controls do not eliminate the vulnerability-patching remains the required long-term remediation. Coordinate patching during a maintenance window to avoid disruption to backup and recovery operations.