CVE-2026-90723
LowCVSS 2.7Summary
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to disclose information.
Risk Assessment
SQL injection may enable unauthorized access to data stored in the management system's database. It requires high privileges but remote access.
Recommendation
Update Dell PowerProtect Data Domain Management Center to a patched version and restrict remote access for privileged accounts.
Other vulnerabilities in Dell PowerProtect Data Domain Management Center
See all- CVE-2026-110540High
Dell PowerProtect Data Domain Management Center contains a Missing Authorization vulnerability. A low privileged attacker with remote access could exploit it to perform unauthorized operations.
- CVE-2026-86391Medium
Dell PowerProtect Data Domain Management Center contains an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of Service.
- CVE-2026-86386Medium
Dell PowerProtect Data Domain Management Center contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.
- CVE-2026-86379High
Dell PowerProtect Data Domain Management Center contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could exploit this vulnerability, leading to command execution.
- CVE-2026-90724Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to disclose information.
- CVE-2026-90719Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to disclose information.
- CVE-2026-86401Low
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. A high privileged attacker with remote access could exploit it to expose information.
- CVE-2026-103799Critical
Dell PowerProtect Data Domain Management Center contains a Missing Authorization vulnerability. A low-privileged attacker with remote access could exploit it to perform unauthorized system operations on managed systems.
- CVE-2026-103792Critical
Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability. A low-privileged attacker with remote access could exploit it to gain unauthorized access to managed systems.
- CVE-2026-90717Critical
Dell PowerProtect Data Domain Management Center contains an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could exploit it to elevate privileges, potentially impacting other managed Data Domain systems.
Original NVD description (English source)
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

