What is the CVSS score of CVE-2026-35073?

CVE-2026-35073 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35073?

Yes, a patch is available for CVE-2026-35073. Update the affected software to the latest version immediately.

Powerprotect Data Domain CVE-2026-35073

EUVD-2026-23406 MEDIUM

OS Command Injection (CWE-78)

2026-04-17 dell

GHSA-pc4q-wmj3-q7jg

Command Injection Dell Powerprotect Data Domain

6.7

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (dell) · only source for this CVE.

CVSS VectorVendor: dell

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 17, 2026 - 15:07 nvd

Patch available

Apr 17, 2026 - 12:01 EUVD

Analysis Generated

Apr 17, 2026 - 11:26 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 11:15 euvd

EUVD-2026-23406

Analysis Generated

Apr 17, 2026 - 11:15 vuln.today

CVE Published

Apr 17, 2026 - 11:05 nvd

MEDIUM 6.7

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

AnalysisAI

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0 and specific LTS releases (8.3.1.0-8.3.1.20, 7.13.1.0-7.13.1.60) contain an OS command injection vulnerability (CWE-78) that allows high-privileged local attackers to execute arbitrary commands with root privileges. The vulnerability stems from improper neutralization of special elements in OS commands, with a CVSS score of 6.7 reflecting high confidentiality, integrity, and availability impact but constrained by local access and high privilege requirements.

Technical ContextAI

Dell PowerProtect Data Domain is a deduplication and backup storage appliance that manages enterprise backup operations. The vulnerability is rooted in CWE-78 (Improper Neutralization of Special Elements used in an OS Command), a classic command injection flaw where user-controllable input or privileged-user-supplied parameters are passed to OS command execution functions without proper sanitization or escaping. The affected versions span the 7.x and 8.x product lines, indicating the vulnerability exists across multiple major releases. The CPE indicates the vulnerability affects Dell PowerProtect Data Domain across all configurations and platforms where this product runs. The attack surface is limited to local access, meaning the attacker must already have some form of shell or management interface access to the appliance.

RemediationAI

Apply the vendor-released security patch from Dell DSA-2026-060 immediately. Customers should upgrade to patched versions confirmed in the Dell advisory-exact patch versions must be obtained directly from the advisory as they are not specified in the CVE description. Until patching is completed, restrict administrative and high-privilege access to PowerProtect Data Domain appliances to only trusted personnel; implement multi-factor authentication for administrative accounts to reduce the likelihood of credential compromise that could serve as a stepping stone for this exploit. Disable or restrict access to command-line interfaces and management APIs from untrusted networks-if the appliance has remote management capabilities, ensure they are disabled or protected by network segmentation and authentication. Monitor system logs and command audit trails for unusual command execution patterns from high-privileged accounts. Note that these compensating controls do not prevent exploitation by legitimately compromised high-privilege accounts; patching remains the primary remediation.