{"id":"CVE-2026-110540","kind":"vulnerability","aliases":["CVE-2026-110540"],"related":[],"title":"Dell PowerProtect Data Domain Management Center: missing authorization allows unauthorized operations","description":"Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized operation.","summary":"Several Dell PowerProtect Data Domain Management Center release lines contain a missing authorization check. A low-privileged remote user can perform operations they should not be allowed to perform.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","data-domain","dell","powerprotect","vendor"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"- Check the installed Data Domain Management Center version against the affected ranges listed in the Dell advisory: Feature Release `7.7.1.0` through `8.8`, LTS2024 `7.13.1.0` through `7.13.1.80`, LTS2025 `8.3.1.0` through `8.3.1.40`, LTS2026 `8.6.1.0` through `8.6.1.20`.","fix":"- Move to a fixed release from Dell's advisory for your release line; the sources do not list the fixed version numbers.","status":"open","published_at":"2026-10-28T11:17:14+00:00","first_seen_at":"2026-10-28T11:32:27+00:00","triaged_at":"2026-10-28T11:33:27+00:00","updated_at":"2026-10-28T11:33:27+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-28T11:33:27Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed release from Dell's advisory for your release line; the sources do not list the fixed version numbers.","reach":"network","title":"Dell PowerProtect Data Domain Management Center: missing authorization allows unauthorized operations","impact":"medium","summary":"Several Dell PowerProtect Data Domain Management Center release lines contain a missing authorization check. A low-privileged remote user can perform operations they should not be allowed to perform.","category":"vendor","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup"],"confidence":0.6,"needs_auth":"yes","worst_case":"low-privileged user performs unauthorized management operations on the appliance","analyst_note":"Fixed versions and the Dell advisory link are not in the sources; find the Dell security advisory for CVE-2026-110540 and confirm the patched release per line.","how_to_check":"- Check the installed Data Domain Management Center version against the affected ranges listed in the Dell advisory: Feature Release `7.7.1.0` through `8.8`, LTS2024 `7.13.1.0` through `7.13.1.80`, LTS2025 `8.3.1.0` through `8.3.1.40`, LTS2026 `8.6.1.0` through `8.6.1.20`.","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"who_is_affected":"Teams that run Dell PowerProtect Data Domain Management Center in the affected version ranges, reachable by low-privileged remote users. Installations on versions outside the listed ranges are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000634,"input_tokens":3407,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110540':14A,17A '-2026':13A,16A '7.13.1.0':70C '7.13.1.80':72C '7.7.1.0':64C '8.3.1.0':76C '8.3.1.40':78C '8.6.1.0':82C '8.6.1.20':84C '8.8':66C 'access':96C 'allow':9A,52B 'attack':93C 'author':8A,37B,88C 'backup':18B 'center':6A,31B,60C 'check':38B 'contain':34B,85C 'could':97C 'cve':12A,15A 'data':3A,20B,28B,57C 'data-domain':19B 'dell':1A,22B,26B,55C 'domain':4A,21B,29B,58C 'exploit':99C 'featur':61C 'lead':102C 'line':33B 'low':41B,91C 'low-privileg':40B 'lts2024':67C 'lts2025':73C 'lts2026':79C 'manag':5A,30B,59C 'miss':7A,36B,87C 'oper':11A,47B,105C 'perform':46B,54B 'potenti':98C 'powerprotect':2A,23B,27B,56C 'privileg':42B,92C 'releas':32B,62C,68C,74C,80C 'remot':43B,95C 'sever':25B 'unauthor':10A,104C 'user':44B 'vendor':24B 'version':63C,69C,75C,81C 'vulner':89C,101C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Dell PowerProtect Data Domain Management Center in the affected version ranges, reachable by low-privileged remote users. Installations on versions outside the listed ranges are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110540","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110540","severity":null,"published_at":"2026-10-28T11:17:14+00:00","modified_at":"2026-10-28T11:17:14+00:00","first_seen_at":"2026-10-28T11:32:27+00:00","fetched_at":"2026-10-28T11:32:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}