Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.
References
Configurations
Configuration 1 (hide)
|
History
08 May 2026, 15:04
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:dell:powerprotect_dp_series_appliance:*:*:*:*:*:*:*:* cpe:2.3:o:dell:data_domain_operating_system:*:*:*:*:*:*:*:* cpe:2.3:o:dell:data_domain_operating_system:8.7.0.0:*:*:*:*:*:*:* |
|
| First Time |
Dell powerprotect Dp Series Appliance
Dell Dell data Domain Operating System |
|
| References | () https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities - Vendor Advisory |
17 Apr 2026, 11:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-17 11:16
Updated : 2026-05-08 15:04
NVD link : CVE-2026-35074
Mitre link : CVE-2026-35074
CVE.ORG link : CVE-2026-35074
JSON object : View
Products Affected
dell
- data_domain_operating_system
- powerprotect_dp_series_appliance
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')