CVE-2026-35153

BRIEFING NOTE: CVE-2026-35153 OVERVIEW Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7.0.0, including LTS2025 (8.3.1.0-8.3.1.20) and LTS2024 (7.13.1.0-7.13.1.60) releases, contain an argument injection vulnerability. An attacker can exploit improper neutralization of argument delimiters in command processing to execute arbitrary commands with root-level privileges. SEVERITY This vulnerability requires local access and high-level privileges to exploit, resulting in a CVSS score of 6.7 (Medium). The attack vector is local with low complexity, but successful exploitation grants complete system compromise through arbitrary command execution with root privileges. The impact spans confidentiality, integrity, and availability. EXPLOITATION STATUS There is no evidence of active exploitation or public exploit availability. The vulnerability does not appear on the Known Exploited Vulnerabilities (KEV) catalog and maintains inactive status on threat hotlists. The EPSS score of 0.00011 indicates minimal probability of exploitation in the wild. Community attention remains limited at this time. RECOMMENDATION Organizations should prioritize patching based on internal exposure assessment, focusing on systems where high-privileged local attackers pose a realistic threat. Regular monitoring for status changes on exploitation fronts is advised given the root-level impact potential.