CVE-2026-35154

CVE-2026-35154 is an improper privilege management vulnerability affecting Dell PowerProtect Data Domain appliances across multiple versions, including releases 7.7.1.0 through 8.7.0.0, specific LTS2025 and LTS2024 versions, impacting the integrated Dell Remote Access Controller (IDRAC) component. A high-privileged attacker with local access to an affected appliance could exploit this vulnerability to elevate privileges and perform unauthorized delete operations within IDRAC that would otherwise be restricted. The vulnerability presents a medium risk profile with a CVSS score of 6.3, requiring local attack vector access and high privileges to exploit, though success is contingent on user interaction. The attack complexity is high, limiting the ease of exploitation, and the potential impact is significant, affecting confidentiality, integrity, and availability of the system through unauthorized deletion capabilities. However, the extremely low EPSS score of 0.00011 and inactive status on public exploit tracking indicate minimal real-world exploitation risk at present. There is no evidence of active exploitation, no public exploit code availability, and no inclusion in the Known Exploited Vulnerabilities catalog. The vulnerability has not attracted significant community attention, as reflected by its inactive status and low FAUCET Risk Score of 35.0 out of 100, suggesting this remains primarily a managed remediation priority rather than an immediate threat requiring emergency response.