CVE-2026-35074 is an OS command injection vulnerability (CWE-78) in Dell PowerProtect Data Domain affecting versions 7.7.1.0 through 8.7.0.0 and specified LTS releases. The vulnerability arises from improper neutralization of special elements in OS commands, enabling a high privileged local attacker to execute arbitrary commands with root privileges. The CVSS 3.1 base score is 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting a medium severity with high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by Dell as of the publication date.

Successful exploitation allows a high privileged local attacker to execute arbitrary OS commands with root privileges, potentially compromising system confidentiality, integrity, and availability. This could lead to full system control by the attacker. However, exploitation requires local access and high privileges, limiting the attack surface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Dell vendor advisory for current remediation guidance. Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity involving command execution. Avoid granting unnecessary high privileges to users on affected systems.