Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2026-90717: Dell PowerProtect Data Domain Management Center allows unauthorized privilege increase
CVE-2026-90717 · published 5 days ago
Summary
Versions of Dell PowerProtect Data Domain Management Center from 7.7.1.0 up to 8.8 and several long‑term support releases can be tricked into accepting a false identity. An attacker who already has a low‑level account and can reach the system over the network could use this to gain higher privileges and affect other managed Data Domain devices. Apply the vendor's recommended updates or patches as soon as possible and restrict network access to trusted users only.
What to do
- Update dell powerprotect data domain management center to version 8.9.0.0 or later or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| dell | powerprotect data domain management center | < 8.9.0.0 or later |
Original advisory text
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40...
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability could impact other managed Data Domain systems.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-290Authentication Bypass by Spoofing
Timeline
Published28 Oct 2026
Updated2 Nov 2026
First seen28 Oct 2026
Track software like this
Free during beta