What is the CVSS score of CVE-2026-35153?

CVE-2026-35153 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-35153?

Yes, a patch is available for CVE-2026-35153. Update the affected software to the latest version immediately.

Powerprotect Data Domain CVE-2026-35153

EUVD-2026-23401 MEDIUM

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-04-17 dell

Code Injection Dell Powerprotect Data Domain

6.7

CVSS 3.1 · Vendor: dell

Severity by source

Vendor (dell) PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (dell) · only source for this CVE.

CVSS VectorVendor: dell

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 17, 2026 - 15:07 nvd

Patch available

Apr 17, 2026 - 11:01 EUVD

Analysis Generated

Apr 17, 2026 - 10:54 vuln.today

EUVD ID Assigned

Apr 17, 2026 - 10:45 euvd

EUVD-2026-23401

Analysis Generated

Apr 17, 2026 - 10:45 vuln.today

CVE Published

Apr 17, 2026 - 10:38 nvd

MEDIUM 6.7

DescriptionCVE.org

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of argument delimiters in a command ('argument injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

AnalysisAI

Dell PowerProtect Data Domain versions 7.7.1.0-8.7.0.0, LTS2025 8.3.1.0-8.3.1.20, and LTS2024 7.13.1.0-7.13.1.60 are vulnerable to argument injection in command processing, allowing high-privileged local attackers to execute arbitrary commands as root. Exploitation requires administrative-level access and local system presence, limiting real-world exposure to insider threats or post-compromise scenarios. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability resides in command-line argument parsing within PowerProtect Data Domain's administrative interface or system utilities. CWE-88 (Argument Injection) occurs when user-supplied input is improperly neutralized before being passed to shell commands or system execution functions. An attacker with high privilege (PR:H in CVSS vector) can inject shell metacharacters or additional command arguments that bypass intended input validation, resulting in execution of unintended commands with the privileges of the process (root in this case). Dell's data protection appliance processes administrative commands that fail to adequately sanitize or quote arguments, creating a post-authentication command execution pathway.

RemediationAI

Upgrade to patched versions as specified in Dell DSA-2026-060. For affected versions, apply the corresponding security update: those running 7.13.1.x (LTS2024) should update to a patched 7.13.1.z release; 8.3.1.x (LTS2025) users should update to a patched 8.3.1.z version; and general-release 7.7.1.0-8.7.0.0 customers should upgrade to the next available patched release (consult the advisory for exact target versions). Until patching is completed, restrict administrative account access to only essential personnel, enforce multi-factor authentication on administrative console access, and implement local access controls to limit which systems and users can reach the Data Domain management interface. Log and monitor all administrative command execution for signs of argument injection payloads. These compensating controls reduce exploitation risk but do not eliminate the underlying code flaw.