CVE-2026-35072: OS Command Injection

Q: What is the severity of CVE-2026-35072?

CVE-2026-35072 is classified as a high severity vulnerability due to its potential for OS command injection.

Q: How do I fix CVE-2026-35072?

To mitigate CVE-2026-35072, update your Dell PowerProtect Data Domain to the latest version released by Dell.

Q: Which versions are affected by CVE-2026-35072?

CVE-2026-35072 affects Dell PowerProtect Data Domain versions 7.7.1.0 to 8.7.0.0, as well as LTS2025 versions 8.3.1.0 to 8.3.1.20 and LTS2024 versions 7.13.1.0 to 7.13.1.60.

Q: What types of attacks can exploit CVE-2026-35072?

CVE-2026-35072 can be exploited through OS command injection attacks, allowing attackers to execute arbitrary commands on the affected system.

Q: Is there a workaround for CVE-2026-35072 if I cannot update immediately?

Currently, there is no official workaround for CVE-2026-35072, so it's advisable to apply the security updates as soon as possible.

Published Apr 17, 2026

Updated

Dell PowerProtect Data Domain Feature Release versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command ('OS command injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

Affected Software

6 affected components

Dell PowerProtect Data Domain>=7.7.1.0<=8.7.0.0, >=8.3.1.0<=8.3.1.20, >=7.13.1.0<=7.13.1.60

Dell Powerprotect Dp Series Appliance<2.7.9

Dell Data Domain Operating System>=7.7.1.0<7.13.1.70

Dell Data Domain Operating System>=7.14.0.0<8.3.1.30

Dell Data Domain Operating System>=8.4.0.0<=8.6.1.10

Dell Data Domain Operating System=8.7.0.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Dell PowerProtect Data Domain Feature Release to a version that resolves this vulnerability.
Fixed in 8.6.0.0
Upgrade
Upgrade Dell PowerProtect Data Domain Feature Release to a version that resolves this vulnerability.
Fixed in 8.7.0.0
Upgrade
Upgrade Dell PowerProtect Data Domain LTS2025 release to a version that resolves this vulnerability.
Fixed in 8.3.1.20
Upgrade
Upgrade Dell PowerProtect Data Domain LTS2024 release to a version that resolves this vulnerability.
Fixed in 7.13.1.60

Event History

Apr 17, 2026

CVE Published

via MITRE·10:48 AM

Data Sourced

via MITRE·10:48 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·11:16 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-35072?

CVE-2026-35072 is classified as a high severity vulnerability due to its potential for OS command injection.

How do I fix CVE-2026-35072?