CVE-2026-90717
CriticalCVSS 9.1Summary
Dell PowerProtect Data Domain Management Center contains an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could exploit it to elevate privileges, potentially impacting other managed Data Domain systems.
Risk Assessment
An attacker with low privileges could gain elevated access on the management system, and the impact may spread to managed Data Domain devices, increasing the risk of compromising the backup infrastructure.
Recommendation
Upgrade Dell PowerProtect Data Domain Management Center to a patched version and restrict remote access to the management interface to trusted networks only.
Other vulnerabilities in Dell PowerProtect Data Domain Management Center
See all- CVE-2026-86391Medium
Dell PowerProtect Data Domain Management Center contains an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of Service.
- CVE-2026-86386Medium
Dell PowerProtect Data Domain Management Center contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.
- CVE-2026-86379High
Dell PowerProtect Data Domain Management Center contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to command execution.
- CVE-2026-90724Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to disclose information.
- CVE-2026-90723Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to disclose information.
- CVE-2026-90719Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to disclose information.
- CVE-2026-86401Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to expose information.
Original NVD description (English source)
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability could impact other managed Data Domain systems.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

