Powerprotect Data Domain CVE-2026-35074

The vulnerability requires high-privilege local access (PR:H) to the PowerProtect Data Domain appliance-specifically, ability to execute commands or interact with management interfaces that process unsanitized input for OS command execution. The exact entry point (management CLI, API endpoint, configuration field) is not specified in the available description but is likely in administrative command-processing functions that accept user input. No special non-default configuration is indicated; any instance with shell access for high-privileged accounts is at risk. Exploitation is limited by the local attack vector (AV:L), which means the attacker must already have legitimate or compromised local access; remote exploitation is not feasible based on the CVSS vector. The vulnerability does not require user interaction (UI:N), meaning if an attacker can provide input to an affected code path, the injection will execute automatically.

CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U) reflects a local attack requiring high privilege (likely admin or service account access), low attack complexity, and no user interaction - indicating a vulnerability readily exploitable by insiders or attackers who have already gained local system access. The CVSS score is moderate despite the severe impact (root code execution) because the attack vector is strictly local (AV:L) and requires high privilege (PR:H), which constrains the attack surface. However, high-privileged local access on backup appliances is a realistic threat in environments where service accounts, administrative shells, or privileged scheduled jobs are compromised. The lack of public exploit code or CISA KEV listing does not diminish risk for organizations where internal threats or lateral movement post-compromise is a concern. The presence of multiple affected release tracks (mainstream and two LTS branches) suggests this is not a narrow edge-case issue but a systemic flaw in command handling. For organizations relying on PowerProtect Data Domain for backup integrity, this represents a realistic attack path if an attacker gains shell access (e.g., via SSH compromise, container escape, or supply-chain tampering of backup scripts). Patch availability should be prioritized given the criticality of backup infrastructure.

An attacker with valid high-privileged credentials (administrative or service account) on a PowerProtect Data Domain appliance uses SSH to access the command line interface. The attacker injects shell metacharacters (e.g., ; id; or $(whoami)) into an input field or command parameter that the appliance processes without sanitization, causing the injected payload to execute as root. This allows the attacker to read sensitive backup data, modify backup schedules, or pivot to connected backup sources and recovery targets.