PT-2026-33436 · Dell · Dell Powerprotect Data Domain

Published 2026-04-14 · Updated 2026-05-08 · CVE-2026-35072

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0 Dell PowerProtect Data Domain versions 8.3.1.0 through 8.3.1.20 Dell PowerProtect Data Domain versions 7.13.1.0 through 7.13.1.60

Description Improper neutralization of special elements used in an OS command allows a high privileged attacker with local access to execute arbitrary commands with root privileges. OS command injection is a flaw where an application sends untrusted data to a system shell, allowing the execution of unauthorized operating system commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-06522

CVE-2026-35072

Affected Products

Dell Powerprotect Data Domain

References · 5

• https://bdu.fstec.ru/vul/2026-06522 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35072 · Security Note
• https://dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2045173549183189345 · Twitter Post
• https://t.me/cveNotify/162721 · Telegram Post