CVE-2026-103799
CriticalCVSS 9.6Summary
Dell PowerProtect Data Domain Management Center contains a Missing Authorization vulnerability. A low-privileged attacker with remote access could exploit it to perform unauthorized system operations on managed systems.
Risk Assessment
This could allow unauthorized changes to managed systems, compromising the integrity and availability of backup infrastructure.
Recommendation
Update the software to a patched version as soon as possible and restrict remote access to the management interface.
Other vulnerabilities in Dell PowerProtect Data Domain Management Center
See all- CVE-2026-110540High
Dell PowerProtect Data Domain Management Center contains a Missing Authorization vulnerability. A low privileged attacker with remote access could exploit it to perform unauthorized operations.
- CVE-2026-86391Medium
Dell PowerProtect Data Domain Management Center contains an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of Service.
- CVE-2026-86386Medium
Dell PowerProtect Data Domain Management Center contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.
- CVE-2026-86379High
Dell PowerProtect Data Domain Management Center contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to command execution.
- CVE-2026-90724Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to disclose information.
- CVE-2026-90723Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to disclose information.
- CVE-2026-90719Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to disclose information.
- CVE-2026-86401Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to expose information.
- CVE-2026-103792Critical
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability. A low-privileged attacker with remote access could exploit it to gain unauthorized access to managed systems.
- CVE-2026-90717Critical
Dell PowerProtect Data Domain Management Center contains an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could exploit it to elevate privileges, potentially impacting other managed Data Domain systems.
Original NVD description (English source)
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized system operation on managed systems.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

