CVE-2026-35073: Dell PowerProtect Data Domain RCE Flaw

CVE-2026-35073 Overview

CVE-2026-35073 is an OS command injection vulnerability affecting Dell PowerProtect Data Domain, a critical enterprise data protection and backup appliance solution. The vulnerability exists due to improper neutralization of special elements used in OS commands (CWE-78), which allows a high-privileged attacker with local access to execute arbitrary commands with root privileges on the affected system.

Dell PowerProtect Data Domain appliances are widely deployed in enterprise environments for data backup, deduplication, and disaster recovery operations. A successful exploit of this vulnerability could allow an attacker who has already obtained high-level privileges on the system to escalate to root-level access, potentially compromising the integrity of backup data and the broader data protection infrastructure.

Critical Impact

High-privileged local attackers can achieve arbitrary command execution with root privileges, potentially compromising enterprise backup infrastructure and sensitive data.

Affected Products

• Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0
• Dell PowerProtect Data Domain LTS2025 release versions 8.3.1.0 through 8.3.1.20
• Dell PowerProtect Data Domain LTS2024 release versions 7.13.1.0 through 7.13.1.60

Discovery Timeline

• 2026-04-17 - CVE-2026-35073 published to NVD
• 2026-04-17 - Last updated in NVD database

Technical Details for CVE-2026-35073

Vulnerability Analysis

This vulnerability falls under CWE-78 (Improper Neutralization of Special Elements used in an OS Command), commonly known as OS command injection. The flaw exists in the way Dell PowerProtect Data Domain processes user-supplied input when constructing operating system commands.

When user-controlled data is incorporated into system commands without proper sanitization or validation, attackers can inject malicious command elements that are interpreted by the underlying operating system shell. In the context of Dell PowerProtect Data Domain, this allows an attacker who already possesses high-level privileges on the system to break out of the application context and execute arbitrary commands with root-level access.

The attack requires local access to the system and high privileges, which limits the initial attack surface but significantly increases the potential impact once exploited. Data Domain appliances often contain sensitive backup data and may have network access to production systems, making root-level compromise particularly concerning.

Root Cause

The root cause of CVE-2026-35073 is insufficient input validation and sanitization when handling user-supplied data that is subsequently used in OS command construction. The application fails to properly neutralize special characters and command separators (such as ;, |, &, $(), or backticks) before passing input to system shell functions.

This deficiency allows attackers to escape the intended command context and inject additional commands that execute with the privileges of the application process—in this case, root privileges on the Data Domain appliance.

Attack Vector

The attack vector for CVE-2026-35073 is local, requiring the attacker to have existing access to the Dell PowerProtect Data Domain system with high privileges. The exploitation scenario involves:

1. An attacker with high-privileged local access identifies an input field or parameter that is incorporated into OS commands
2. The attacker crafts malicious input containing command injection payloads with special shell characters
3. The unsanitized input is passed to a system shell for execution
4. The injected commands execute with root privileges, granting the attacker full control of the appliance

The vulnerability does not require user interaction and has low attack complexity once the prerequisite access is obtained. Successful exploitation impacts the confidentiality, integrity, and availability of the affected system.

Detection Methods for CVE-2026-35073

Indicators of Compromise

• Unexpected root-level processes spawned from Data Domain application contexts
• Unusual command execution patterns in system audit logs, particularly those containing shell metacharacters
• Modification of system files or configurations outside of normal maintenance windows
• Creation of unauthorized user accounts or SSH keys on the Data Domain appliance
• Anomalous network connections originating from the Data Domain system

Detection Strategies

• Enable comprehensive audit logging on Dell PowerProtect Data Domain appliances to capture command execution events
• Implement file integrity monitoring on critical system files and configuration directories
• Monitor for process execution anomalies, particularly shell processes spawned as child processes of Data Domain services
• Deploy endpoint detection and response (EDR) solutions capable of detecting command injection patterns

Monitoring Recommendations

• Configure centralized log collection for all Data Domain appliances with alerting on suspicious command patterns
• Establish baseline behavior for administrative activities and alert on deviations
• Monitor privilege escalation events and root-level command execution
• Review access logs for unusual local access patterns or authentication anomalies

How to Mitigate CVE-2026-35073

Immediate Actions Required

• Apply the latest security updates from Dell as documented in Dell Security Update DSA-2026-060
• Review and restrict high-privilege access to Data Domain appliances to only essential personnel
• Audit current user accounts and access permissions on affected systems
• Implement network segmentation to limit access to Data Domain management interfaces
• Enable enhanced logging and monitoring on all affected appliances

Patch Information

Dell has released security updates to address CVE-2026-35073 and multiple other vulnerabilities in PowerProtect Data Domain. Organizations should upgrade to patched versions as specified in the Dell Security Advisory DSA-2026-060. Review the official Dell security advisory for specific patch versions and upgrade instructions for your deployment.

Workarounds

• Implement strict least-privilege access controls, limiting high-privilege accounts to essential operations only
• Enforce multi-factor authentication for all administrative access to Data Domain appliances
• Restrict local access to Data Domain systems using network access control lists and firewall rules
• Implement separation of duties for administrative functions to reduce the risk of insider threats
• Monitor and alert on all administrative activities pending patch deployment

# Example: Restrict SSH access to Data Domain management
# Add to firewall rules to limit management access to trusted hosts only
iptables -A INPUT -p tcp --dport 22 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP