{"id":"CVE-2026-35154","title":"Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege\n managem…","summary":"Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege\n managem…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-269"],"vendor":"dell","product":"data_domain_operating_system","affected":["data_domain_operating_system >= 7.13.1.0, < 7.13.1.70","data_domain_operating_system >= 8.3.0.0, < 8.3.1.30","data_domain_operating_system >= 8.4.0.0, < 8.6.1.0"],"patched":["data_domain_operating_system 8.6.1.0"],"published":"2026-04-20","updated":"2026-10-14","sourceUpdated":"2026-10-14T15:17:20.130","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35154","references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000450699/dsa-2026-060-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities","label":"security_alert@emc.com"}],"tags":["nvd","cve.org"],"epss":0.00127,"epssPercentile":0.0211,"ingestedAt":"2026-10-14T15:36:13.933Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-04-21T00:00:00+00:00"},"slug":"CVE-2026-35154","body":"## Overview\n\nDell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege\n management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation.\n\n## Affected\n\n- `data_domain_operating_system >= 7.13.1.0, < 7.13.1.70`\n- `data_domain_operating_system >= 8.3.0.0, < 8.3.1.30`\n- `data_domain_operating_system >= 8.4.0.0, < 8.6.1.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `data_domain_operating_system 8.6.1.0`","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}