What is the CVSS score of CVE-2026-35074?

CVE-2026-35074 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35074?

Yes, a patch is available for CVE-2026-35074. Update the affected software to the latest version immediately.

Powerprotect Data Domain CVE-2026-35074

EUVD-2026-23407 MEDIUM

OS Command Injection (CWE-78)

2026-04-17 dell

Dell Command Injection Powerprotect Data Domain

6.7

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (dell) · only source for this CVE.

CVSS VectorVendor: dell

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 17, 2026 - 15:07 nvd

Patch available

Apr 17, 2026 - 12:01 EUVD

Analysis Generated

Apr 17, 2026 - 11:26 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 11:15 euvd

EUVD-2026-23407

Analysis Generated

Apr 17, 2026 - 11:15 vuln.today

CVE Published

Apr 17, 2026 - 10:57 nvd

MEDIUM 6.7

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

AnalysisAI

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0, LTS2025 releases 8.3.1.0-8.3.1.20, and LTS2024 releases 7.13.1.0-7.13.1.60 allow local high-privileged attackers to execute arbitrary OS commands with root privileges via improper neutralization of special elements in command construction (OS command injection). No public exploit code or active exploitation has been identified at the time of analysis, but the vulnerability affects critical backup and disaster recovery infrastructure with direct root access potential.

Technical ContextAI

The vulnerability resides in Dell PowerProtect Data Domain's command processing logic, which fails to properly sanitize or escape special shell metacharacters before passing user-supplied or system-derived input to OS command execution functions. This is a classic OS command injection vulnerability (CWE-78), where an attacker can inject shell metacharacters (such as pipes |, semicolons ;, command substitution $()/``, or redirects >, <) to break out of the intended command context and execute arbitrary commands. The affected versions span multiple release branches (mainstream 7.7.x-8.7.x, LTS2024 7.13.1.x, and LTS2025 8.3.1.x), indicating the root cause may exist in shared code across release maintenance tracks. Dell PowerProtect Data Domain is a deduplication and backup appliance running on hardened Linux-based systems; command injection at the appliance management layer can compromise the entire backup ecosystem.

RemediationAI

Apply the security patch provided in Dell Security Advisory DSA-2026-060 as the primary mitigation. Consult the advisory for exact patched version numbers for each release track (7.7.x, 8.3.1.x LTS2025, 7.13.1.x LTS2024). Until patching is possible, restrict local shell access to PowerProtect Data Domain appliances to trusted administrative personnel only; review and audit SSH keys, service account credentials, and scheduled job definitions (cron, systemd timers) that interact with system command execution. Disable or restrict access to any management interfaces or APIs that allow command-like inputs if feasible, and monitor system logs (auth.log, audit logs) for unauthorized privilege escalation or unexpected command execution patterns. Implement network segmentation to limit access to backup appliance management ports to trusted administrative networks only. Note that these workarounds do not eliminate the vulnerability and increase operational overhead; patching should be prioritized.