CVE-2026-35153

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of argument delimiters in a command ('argument injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

Score

CVSS 3.1 6.7 Medium

Status

Modified - security_alert@emc.com

Published

2026-04-17

Last modified

2026-10-26

Weaknesses

CWE-88

Affected products

• Data Domain Operating System (Dell)
• Powerprotect Data Domain (Dell)
• Powerprotect Dp Series Appliance (Dell)

References

• https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multi…