CVE-2026-35072: Dell PowerProtect Data Domain RCE Flaw

CVE-2026-35072 Overview

A critical OS command injection vulnerability has been identified in Dell PowerProtect Data Domain, a widely deployed enterprise backup and recovery appliance. This vulnerability (CWE-78) allows a high-privileged attacker with local access to execute arbitrary commands with root privileges, potentially compromising the entire data protection infrastructure.

Critical Impact

Successful exploitation enables arbitrary command execution with root privileges, potentially leading to complete system compromise of enterprise backup infrastructure.

Affected Products

• Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0
• Dell PowerProtect Data Domain LTS2025 release versions 8.3.1.0 through 8.3.1.20
• Dell PowerProtect Data Domain LTS2024 release versions 7.13.1.0 through 7.13.1.60

Discovery Timeline

• 2026-04-17 - CVE CVE-2026-35072 published to NVD
• 2026-04-17 - Last updated in NVD database

Technical Details for CVE-2026-35072

Vulnerability Analysis

This vulnerability stems from improper neutralization of special elements used in OS commands (CWE-78), commonly known as OS command injection. The Dell PowerProtect Data Domain appliance fails to properly sanitize user-supplied input before incorporating it into operating system commands.

An attacker with high-level administrative privileges and local access to the system can craft malicious input containing shell metacharacters or command separators. When this input is processed by the vulnerable component, the injected commands execute with the privileges of the underlying process—in this case, root privileges.

The local attack vector and requirement for high privileges somewhat limits the attack surface, but the potential impact is severe given that successful exploitation grants full root access to the backup appliance. Data protection systems like PowerProtect Data Domain often contain sensitive enterprise data and credentials, making them high-value targets.

Root Cause

The root cause is insufficient input validation and sanitization in the command processing logic. User-controlled input is passed directly to system command execution functions without proper escaping or parameterization of special characters such as semicolons (;), pipes (|), backticks (`), or command substitution syntax ($()).

Attack Vector

The attack requires local access to the Dell PowerProtect Data Domain appliance with high-privilege credentials. An attacker must authenticate with administrative privileges before being able to inject malicious commands through the vulnerable interface. The injected commands bypass normal access controls and execute directly at the operating system level with root privileges.

The vulnerability mechanism involves injecting shell metacharacters into input fields that are subsequently processed by system command execution functions. Due to the lack of proper input sanitization, the malicious payload executes alongside or instead of the intended legitimate commands.

Detection Methods for CVE-2026-35072

Indicators of Compromise

• Unusual process execution patterns originating from PowerProtect Data Domain administrative interfaces
• Unexpected child processes spawned by Data Domain system services with root privileges
• Anomalous shell commands in system logs, particularly those containing command chaining operators
• Evidence of data exfiltration or lateral movement originating from the backup appliance

Detection Strategies

• Monitor authentication logs for suspicious privileged access attempts to PowerProtect Data Domain systems
• Implement command-line logging and analyze for shell metacharacters in administrative input
• Deploy endpoint detection and response (EDR) solutions to identify unusual process trees and command execution
• Audit system call activity for unexpected command interpreter invocations

Monitoring Recommendations

• Enable comprehensive logging on all Dell PowerProtect Data Domain appliances
• Configure SIEM rules to alert on anomalous root-level command execution
• Monitor network traffic from backup infrastructure for signs of data exfiltration
• Review administrative access patterns and establish baselines for normal activity

How to Mitigate CVE-2026-35072

Immediate Actions Required

• Apply the security patches provided by Dell as documented in Dell Security Update Advisory DSA-2026-060
• Restrict local administrative access to PowerProtect Data Domain systems to essential personnel only
• Audit existing administrative accounts and remove unnecessary high-privilege access
• Implement network segmentation to isolate backup infrastructure from general network access

Patch Information

Dell has released security updates to address this vulnerability. Organizations should reference the Dell Security Update Advisory DSA-2026-060 for specific patch versions and upgrade instructions. Upgrade to the latest patched versions beyond the affected version ranges listed above.

Workarounds

• Implement strict access controls limiting local administrative access to the minimum required personnel
• Enable multi-factor authentication for all administrative access to PowerProtect Data Domain systems
• Deploy network access controls to restrict which systems can connect to the Data Domain management interfaces
• Monitor administrative sessions with privileged access management (PAM) solutions to detect suspicious activity

# Example: Verify current PowerProtect Data Domain version
# Access the Data Domain system and check version
# system show version

# Restrict SSH access to specific management networks
# Configure firewall rules to limit administrative access
# iptables -A INPUT -p tcp --dport 22 -s <management_network> -j ACCEPT
# iptables -A INPUT -p tcp --dport 22 -j DROP