CVE-2026-35073 is an OS command injection vulnerability (CWE-78) in Dell PowerProtect Data Domain affecting Feature Release versions 7.7.1.0 through 8.6.0.0 and 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, and LTS2024 release versions 7.13.1.0 through 7.13.1.60. The vulnerability results from improper neutralization of special elements used in OS commands, which could allow a high privileged attacker with local access to execute arbitrary commands with root privileges. The CVSS vector indicates the attack requires local access, low attack complexity, high privileges, no user interaction, and impacts confidentiality, integrity, and availability with high severity. No vendor advisory or patch information is currently available, and no known exploits have been reported.

A high privileged attacker with local access could exploit this vulnerability to execute arbitrary OS commands with root privileges, potentially compromising the confidentiality, integrity, and availability of the affected system. This could lead to full system compromise or unauthorized control over the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for suspicious activity. Avoid running untrusted code or commands on affected versions.