Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.6

Dell PowerProtect Management Center may let remote attackers access systems

CVE-2026-103792 · published 5 days ago
Summary

Versions of Dell PowerProtect Data Domain Management Center up to 8.8 contain a flaw that can let an attacker with low privileges connect over the network and run unauthorized commands. This could give the attacker access to the systems the console manages. Apply the latest patches from Dell as soon as possible to close the gap.

What to do
  • Update dell powerprotect data domain management center to version 8.9.0.0 or later or later.
Affected software
VendorProductAffected versions
dell powerprotect data domain management center < 8.9.0.0 or later
Original advisory text
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40...
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access to managed systems.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.6 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published28 Oct 2026
Updated29 Oct 2026
First seen28 Oct 2026
Sources
CVE-2026-103792 · NVD
CVE-2026-103792 · MITRE
Track software like this
Free during beta