CVE-2026-35073 is an OS command injection vulnerability (CWE-78) affecting Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0 and specific LTS releases. The flaw arises from improper neutralization of special elements in OS commands, allowing a high privileged local attacker to execute arbitrary commands with root privileges. The CVSS 3.1 base score is 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting medium severity with high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the product is not a cloud service.

Successful exploitation would allow a high privileged local attacker to execute arbitrary OS commands with root privileges, potentially compromising system confidentiality, integrity, and availability. This could lead to full system compromise on affected Dell PowerProtect Data Domain devices. However, exploitation requires local access with high privileges, limiting the attack surface. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity involving command execution. Do not assume the vulnerability is mitigated without vendor confirmation.