CVE-2026-35074: Dell PowerProtect Data Domain RCE Flaw

CVE-2026-35074 Overview

CVE-2026-35074 is an OS Command Injection vulnerability affecting Dell PowerProtect Data Domain appliances across multiple versions. The vulnerability stems from improper neutralization of special elements used in operating system commands, classified as CWE-78. A high-privileged attacker with local access could exploit this flaw to execute arbitrary commands with root privileges, potentially leading to complete system compromise.

Critical Impact

Successful exploitation allows arbitrary command execution with root privileges, enabling full control over the affected Dell PowerProtect Data Domain appliance.

Affected Products

• Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0
• Dell PowerProtect Data Domain LTS2025 release versions 8.3.1.0 through 8.3.1.20
• Dell PowerProtect Data Domain LTS2024 release versions 7.13.1.0 through 7.13.1.60

Discovery Timeline

• April 17, 2026 - CVE-2026-35074 published to NVD
• April 17, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35074

Vulnerability Analysis

This vulnerability exists within Dell PowerProtect Data Domain appliances due to insufficient input validation and sanitization of user-controlled data before it is passed to operating system command interpreters. When exploited, the vulnerability allows an attacker to inject malicious commands that are executed by the underlying system shell with elevated (root) privileges.

The attack requires local access to the system and high privileges, which somewhat limits the attack surface. However, in enterprise environments where Data Domain appliances serve as critical backup infrastructure, any compromise could have severe consequences for data integrity and availability. An attacker who gains initial access through other means could leverage this vulnerability to escalate privileges and establish persistent access to the backup infrastructure.

Root Cause

The root cause is improper neutralization of special elements (CWE-78). The affected software fails to properly sanitize or escape special characters and command separators (such as ;, |, &, or backticks) in user-supplied input before incorporating that input into OS commands. This allows an attacker to break out of the intended command context and inject additional commands.

Attack Vector

The attack vector is local, requiring the attacker to have existing access to the Dell PowerProtect Data Domain system. The attacker must possess high privileges on the system to reach the vulnerable functionality. Once access is obtained, the attacker can inject specially crafted input containing OS command syntax that, when processed by the vulnerable component, results in the execution of arbitrary commands with root-level privileges.

The exploitation chain typically involves:

1. Gaining local access to the Data Domain appliance with a high-privileged account
2. Identifying input fields or parameters that are passed to system commands
3. Crafting malicious input containing command injection payloads
4. Triggering the vulnerable functionality to execute injected commands with root privileges

Detection Methods for CVE-2026-35074

Indicators of Compromise

• Unexpected command execution or shell spawning from Data Domain management processes
• Anomalous root-level process activity on the appliance
• Unusual user session activity from high-privileged accounts
• Unauthorized changes to system configuration or backup policies

Detection Strategies

• Monitor system logs for command execution anomalies, particularly commands containing shell metacharacters (;, |, &, backticks)
• Implement file integrity monitoring on critical system files and configurations
• Review audit logs for privilege escalation attempts or unexpected root command execution
• Deploy endpoint detection capabilities to identify suspicious process lineage and command patterns

Monitoring Recommendations

• Enable verbose logging on Dell PowerProtect Data Domain appliances to capture command execution details
• Configure SIEM rules to alert on unusual administrative activity patterns
• Regularly audit user accounts with high privileges for unauthorized access
• Monitor network traffic for data exfiltration indicators following potential exploitation

How to Mitigate CVE-2026-35074

Immediate Actions Required

• Apply the security patch provided by Dell immediately to all affected Data Domain appliances
• Audit and restrict high-privileged account access to only essential personnel
• Review recent access logs for suspicious activity that may indicate prior exploitation
• Implement network segmentation to limit access to Data Domain management interfaces

Patch Information

Dell has released a security update to address this vulnerability. The patch is documented in Dell Security Update DSA-2026-060. Organizations should upgrade to a patched version that is outside the affected version ranges:

• Versions prior to 7.7.1.0 (if supported)
• Versions after 8.7.0.0 with the security fix
• LTS2025 versions after 8.3.1.20 with the security fix
• LTS2024 versions after 7.13.1.60 with the security fix

Consult the Dell security advisory for specific patched version numbers and upgrade instructions.

Workarounds

• Limit local access to Data Domain appliances to essential administrative personnel only
• Implement strict role-based access control and audit all privileged account usage
• Enable multi-factor authentication for administrative access where supported
• Place Data Domain management interfaces on isolated network segments with restricted access

# Example: Restrict SSH access to Data Domain management interface
# Configure firewall rules to limit access to trusted management hosts only
# This limits potential attack surface while patching is planned

# On network firewall, restrict SSH (port 22) access
iptables -A INPUT -p tcp --dport 22 -s <trusted_mgmt_network> -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP