CVE-2026-35153 is an argument injection vulnerability in Dell PowerProtect Data Domain affecting versions 7.7.1.0 through 8.7.0.0 and specific LTS releases. The vulnerability arises from improper neutralization of argument delimiters in commands, enabling a local attacker with high privileges to execute arbitrary commands as root. The CVSS 3.1 base score is 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), reflecting the need for local high-privileged access but with high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

A successful exploit allows a high privileged local attacker to execute arbitrary commands with root privileges on affected Dell PowerProtect Data Domain systems. This can lead to full system compromise, including unauthorized access, modification, or disruption of data and services. The vulnerability requires local access and high privileges, limiting remote exploitation risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict local access to trusted administrators only and monitor for suspicious activity involving command execution. Avoid granting unnecessary high privileges to users on affected systems.