CVE-2026-35154: Dell PowerProtect Privilege Escalation

CVE-2026-35154 Overview

Dell PowerProtect Data Domain appliances contain an improper privilege management vulnerability in IDRAC (Integrated Dell Remote Access Controller). This security flaw affects versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60. The vulnerability allows a high-privileged attacker with local access to elevate their privileges and perform unauthorized delete operations within the IDRAC interface.

Critical Impact

A privileged local attacker can escalate privileges within IDRAC to execute unauthorized delete operations, potentially compromising backup data integrity and system availability.

Affected Products

• Dell PowerProtect Data Domain appliances versions 7.7.1.0 through 8.7.0.0
• Dell PowerProtect Data Domain LTS2025 release versions 8.3.1.0 through 8.3.1.20
• Dell PowerProtect Data Domain LTS2024 release versions 7.13.1.0 through 7.13.1.60

Discovery Timeline

• 2026-04-20 - CVE CVE-2026-35154 published to NVD
• 2026-04-20 - Last updated in NVD database

Technical Details for CVE-2026-35154

Vulnerability Analysis

This vulnerability stems from improper privilege management (CWE-269) within the IDRAC component of Dell PowerProtect Data Domain appliances. IDRAC provides out-of-band management capabilities for Dell systems, allowing administrators to remotely monitor and manage hardware components. The flaw exists in how privilege boundaries are enforced within the IDRAC interface.

The vulnerability requires a high-privileged local user to exploit, combined with user interaction and specific access conditions. While the attacker must already have elevated privileges on the system, successful exploitation allows them to bypass intended access controls and perform delete operations they would not normally be authorized to execute.

The impact of this vulnerability affects all three security pillars—confidentiality, integrity, and availability—as unauthorized delete operations could compromise sensitive backup configurations, destroy critical data protection metadata, or disrupt the availability of the Data Domain appliance.

Root Cause

The root cause is classified as CWE-269 (Improper Privilege Management). The IDRAC component fails to properly validate and restrict privilege boundaries for delete operations. When a user with certain administrative privileges attempts specific delete actions, the privilege verification mechanism does not adequately check whether the user is authorized for that particular operation, allowing privilege escalation within the IDRAC context.

Attack Vector

Exploitation requires local access to the Dell PowerProtect Data Domain appliance with high privileges already established. The attack vector is local, meaning the attacker must have direct or terminal access to the system. Additionally, user interaction is required as part of the exploitation chain, and the complexity of the attack is considered high due to the specific conditions that must be met.

An attacker would need to:

1. Gain high-privileged access to the affected Data Domain appliance
2. Access the IDRAC management interface
3. Manipulate privilege boundaries to execute unauthorized delete operations

The vulnerability does not allow remote exploitation and requires an attacker to already have significant access to the target system, which limits the attack surface but still poses a risk in scenarios involving insider threats or compromised administrative accounts.

Detection Methods for CVE-2026-35154

Indicators of Compromise

• Unexpected delete operations logged in IDRAC audit logs that do not correspond to authorized administrative actions
• Anomalous privilege escalation patterns within IDRAC user sessions
• Missing or deleted IDRAC configurations, user accounts, or system policies without documented change requests
• Audit log entries showing privilege-level mismatches between user roles and executed operations

Detection Strategies

• Monitor IDRAC audit logs for delete operations performed by users whose role assignments should not permit such actions
• Implement file integrity monitoring on critical IDRAC configuration files and directories
• Configure alerting for any privilege escalation events or role modifications within IDRAC
• Deploy SentinelOne agents on management networks to detect anomalous local access patterns to Data Domain appliances

Monitoring Recommendations

• Enable verbose logging in IDRAC and forward logs to a centralized SIEM for correlation and analysis
• Establish baseline behavior for administrative operations and alert on deviations
• Implement real-time monitoring of IDRAC management interface access and operation logs
• Review IDRAC user accounts and privilege assignments regularly to identify potential misconfigurations

How to Mitigate CVE-2026-35154

Immediate Actions Required

• Review and inventory all Dell PowerProtect Data Domain appliances to identify systems running vulnerable versions
• Apply the security update from Dell as documented in Dell Security Update DSA-2026-060
• Restrict local access to Data Domain appliances to only essential personnel
• Audit current IDRAC user accounts and remove or disable any unnecessary high-privileged accounts

Patch Information

Dell has released security updates to address this vulnerability. Administrators should consult the Dell Security Update DSA-2026-060 advisory for specific patch versions and installation instructions. Organizations should prioritize patching based on the criticality of affected Data Domain appliances and their role in the data protection infrastructure.

Workarounds

• Implement strict role-based access control (RBAC) within IDRAC, limiting high-privilege accounts to only those absolutely required
• Enable multi-factor authentication (MFA) for IDRAC access where supported
• Isolate IDRAC management interfaces on dedicated management networks with restricted access
• Implement network segmentation to limit local access paths to Data Domain appliances
• Monitor and audit all IDRAC operations until patches can be applied

# Configuration example - Restrict IDRAC network access
# Add firewall rules to limit IDRAC management interface access
iptables -A INPUT -p tcp --dport 443 -s 192.168.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
# Replace 192.168.100.0/24 with your trusted management network