CVE-2026-35072 is an OS command injection vulnerability (CWE-78) affecting Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0, including LTS2025 and LTS2024 release versions. The vulnerability arises from improper neutralization of special elements in OS commands, which can be exploited by a local attacker with high privileges to execute arbitrary commands as root. The CVSS v3.1 base score is 6.7, reflecting a medium severity with local attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

A high privileged local attacker could exploit this vulnerability to execute arbitrary OS commands with root privileges on affected Dell PowerProtect Data Domain systems. This could lead to full system compromise, including unauthorized access, modification, or disruption of system operations. The impact affects confidentiality, integrity, and availability of the system. There are no reports of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted administrators only and monitor for suspicious activity. Avoid running untrusted code or commands on affected systems. Follow Dell's official communications for updates on patches or mitigations.