CVE-2026-35074 is an OS command injection vulnerability (CWE-78) affecting Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0 and LTS releases 8.3.1.0 through 8.3.1.20 and 7.13.1.0 through 7.13.1.60. The issue arises from improper neutralization of special elements in OS commands, which can be exploited by a high privileged local attacker to execute arbitrary commands with root privileges. The CVSS v3.1 base score is 6.7, reflecting a medium severity with local attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

A high privileged attacker with local access could exploit this vulnerability to execute arbitrary OS commands with root privileges, potentially compromising system confidentiality, integrity, and availability. The medium CVSS score reflects the requirement for local high privileges and the significant impact if exploited. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted users only and monitor for suspicious activity. No official remediation or temporary fixes have been published by Dell at this time.