CVE-2026-90717
Dell PowerProtect Data Domain Management Center
- Dell PowerProtect Data Domain Management Center
- Critical
- CVSS 9.1
- Fixed version listed
Summary
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing vulnerability.
From the CVE record.
Read the original description
CVE record
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability could impact other managed Data Domain systems.
What to do
Fixed version listed
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Dell PowerProtect Data Domain Management Center | before 8.9.0.0 or later; before 7.13.1.90 or later; before 8.3.1.50 or later; before 8.6.1.30 or later | 8.9.0.0 or later |
Advisories and fixes
- Vendor advisory www.dell.com
Scores and signals
- Exploitation
- No known exploitation
- Severity
- Critical, CVSS 9.1 (v3.1, scored by dell)
- Weakness
- CWE-290: Authentication Bypass by Spoofing
- Vendor
- Dell, PowerProtect Data Domain Management Center
Timeline
- First listed as critical by cve.now. Affected and fixed versions come from the CVE record, once one is published.