CVE-2026-35073: Dell PowerProtect Data Domain RCE Flaw

CVE-2026-35073 Overview

CVE-2026-35073 is an OS command injection vulnerability affecting Dell PowerProtect Data Domain, a critical enterprise data protection and backup appliance solution. The vulnerability exists due to improper neutralization of special elements used in OS commands (CWE-78), which allows a high-privileged attacker with local access to execute arbitrary commands with root privileges on the affected system.

Dell PowerProtect Data Domain appliances are widely deployed in enterprise environments for data backup, deduplication, and disaster recovery operations. A successful exploit of this vulnerability could allow an attacker who has already obtained high-level privileges on the system to escalate to root-level access, potentially compromising the integrity of backup data and the broader data protection infrastructure.

Critical Impact
High-privileged local attackers can achieve arbitrary command execution with root privileges, potentially compromising enterprise backup infrastructure and sensitive data.

Affected Products

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0
Dell PowerProtect Data Domain LTS2025 release versions 8.3.1.0 through 8.3.1.20
Dell PowerProtect Data Domain LTS2024 release versions 7.13.1.0 through 7.13.1.60

Discovery Timeline

2026-04-17 - CVE-2026-35073 published to NVD
2026-04-17 - Last updated in NVD database

Technical Details for CVE-2026-35073

Vulnerability Analysis

This vulnerability falls under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS command injection. The flaw exists in the way Dell PowerProtect Data Domain processes user-supplied input when constructing operating system commands.

When user-controlled data is incorporated into system commands without proper sanitization or validation, attackers can inject malicious command elements that are interpreted by the underlying operating system shell. In the context of Dell PowerProtect Data Domain, this allows an attacker who already possesses high-level privileges on the system to break out of the application context and execute arbitrary commands with root-level access.

The attack requires local access to the system and high privileges, which limits the initial attack surface but significantly increases the potential impact once exploited. Data Domain appliances often contain sensitive backup data and may have network access to production systems, making root-level compromise particularly concerning.

Root Cause

The root cause of CVE-2026-35073 is insufficient input validation and sanitization when handling user-supplied data that is subsequently used in OS command construction. The application fails to properly neutralize special characters and command separators (such as ;, |, &, $(), or backticks) before passing input to system shell functions.

This deficiency allows attackers to escape the intended command context and inject additional commands that execute with the privileges of the application process—in this case, root privileges on the Data Domain appliance.

Attack Vector

The attack vector for CVE-2026-35073 is local, requiring the attacker to have existing access to the Dell PowerProtect Data Domain system with high privileges. The exploitation scenario involves:

An attacker with high-privileged local access identifies an input field or parameter that is incorporated into OS commands
The attacker crafts malicious input containing command injection payloads with special shell characters
The unsanitized input is passed to a system shell for execution
The injected commands execute with root privileges, granting the attacker full control of the appliance

The vulnerability does not require user interaction and has low attack complexity once the prerequisite access is obtained. Successful exploitation impacts the confidentiality, integrity, and availability of the affected system.

Detection Methods for CVE-2026-35073

Indicators of Compromise

Unexpected root-level processes spawned from Data Domain application contexts
Unusual command execution patterns in system audit logs, particularly those containing shell metacharacters
Modification of system files or configurations outside of normal maintenance windows
Creation of unauthorized user accounts or SSH keys on the Data Domain appliance
Anomalous network connections originating from the Data Domain system

Detection Strategies

Enable comprehensive audit logging on Dell PowerProtect Data Domain appliances to capture command execution events
Implement file integrity monitoring on critical system files and configuration directories
Monitor for process execution anomalies, particularly shell processes spawned as child processes of Data Domain services
Deploy endpoint detection and response (EDR) solutions capable of detecting command injection patterns

Monitoring Recommendations

Configure centralized log collection for all Data Domain appliances with alerting on suspicious command patterns
Establish baseline behavior for administrative activities and alert on deviations
Monitor privilege escalation events and root-level command execution
Review access logs for unusual local access patterns or authentication anomalies

How to Mitigate CVE-2026-35073

Immediate Actions Required

Apply the latest security updates from Dell as documented in Dell Security Update DSA-2026-060
Review and restrict high-privilege access to Data Domain appliances to only essential personnel
Audit current user accounts and access permissions on affected systems
Implement network segmentation to limit access to Data Domain management interfaces
Enable enhanced logging and monitoring on all affected appliances

Patch Information

Dell has released security updates to address CVE-2026-35073 and multiple other vulnerabilities in PowerProtect Data Domain. Organizations should upgrade to patched versions as specified in the Dell Security Advisory DSA-2026-060. Review the official Dell security advisory for specific patch versions and upgrade instructions for your deployment.

Workarounds

Implement strict least-privilege access controls, limiting high-privilege accounts to essential operations only
Enforce multi-factor authentication for all administrative access to Data Domain appliances
Restrict local access to Data Domain systems using network access control lists and firewall rules
Implement separation of duties for administrative functions to reduce the risk of insider threats
Monitor and alert on all administrative activities pending patch deployment

bash

# Example: Restrict SSH access to Data Domain management
# Add to firewall rules to limit management access to trusted hosts only
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP