CVE-2026-35154CWE-269privilege-escalation

CVE-2026-35154

Medium · published April 20, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
2.2
In the wild
Unconfirmed
What it is

Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege

management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00127 · 2.2th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-04-20T21:16Z
Affected products (3)
ProductVersionsFixed in
dell/data_domain_operating_system≥ 7.13.1.0, < 7.13.1.707.13.1.70
dell/data_domain_operating_system≥ 8.3.0.0, < 8.3.1.308.3.1.30
dell/data_domain_operating_system≥ 8.4.0.0, < 8.6.1.08.6.1.0
References (1)
https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities · [email protected]
EPSS history
Timeline
  • 20 APR 16:50Z
    Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions…
    cvelistv5