Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
References
Configurations
Configuration 1 (hide)
|
History
08 May 2026, 15:09
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Dell
Dell data Domain Operating System |
|
| References | () https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities - Vendor Advisory | |
| CPE | cpe:2.3:o:dell:data_domain_operating_system:8.7.0.0:*:*:*:*:*:*:* cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:* |
17 Apr 2026, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-17 11:16
Updated : 2026-05-08 15:09
NVD link : CVE-2026-35073
Mitre link : CVE-2026-35073
CVE.ORG link : CVE-2026-35073
JSON object : View
Products Affected
dell
- data_domain_operating_system
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')