CVE-2026-103792
Dell PowerProtect Data Domain Management Center
- Dell PowerProtect Data Domain Management Center
- Critical
- CVSS 9.6
- Fixed version listed
Summary
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL…
From the CVE record.
Read the original description
CVE record
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access to managed systems.
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Dell PowerProtect Data Domain Management Center | before 8.9.0.0 or later; before 7.13.1.90 or later; before 8.3.1.50 or later; before 8.6.1.30 or later | 8.9.0.0 or later |
Advisories and fixes
- Vendor advisory www.dell.com
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.6 (v3.1, scored by dell)
- Weakness
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- Vendor
- Dell, PowerProtect Data Domain Management Center
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.