{"id":"CVE-2026-90717","kind":"vulnerability","aliases":["CVE-2026-90717"],"related":[],"title":"Dell PowerProtect Data Domain Management Center: authentication bypass lets low-privilege users escalate","description":"Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability could impact other managed Data Domain systems.","summary":"Dell PowerProtect Data Domain Management Center has an authentication bypass by spoofing in several release lines. A low-privileged remote attacker could exploit it to elevate privileges, and the flaw could affect the managed Data Domain systems too.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","data-domain","dell","infrastructure","powerprotect","self-hosted"],"not_affected_if":["version-outside-affected-ranges"],"how_to_check":"- Check the installed Data Domain Management Center version against the affected ranges in the Dell advisory (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20)\n- Confirm the version from the appliance management interface or the Dell support bundle; exact commands unknown","fix":"- Move Data Domain Management Center to a fixed release listed in the Dell security advisory for CVE-2026-90717; the fixed version numbers are unknown from these sources","status":"open","published_at":"2026-10-28T09:17:08+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","triaged_at":"2026-10-28T09:33:59+00:00","updated_at":"2026-10-28T09:33:59+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T09:33:59Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain Management Center to a fixed release listed in the Dell security advisory for CVE-2026-90717; the fixed version numbers are unknown from these sources","reach":"network","title":"Dell PowerProtect Data Domain Management Center: authentication bypass lets low-privilege users escalate","impact":"high","summary":"Dell PowerProtect Data Domain Management Center has an authentication bypass by spoofing in several release lines. A low-privileged remote attacker could exploit it to elevate privileges, and the flaw could affect the managed Data Domain systems too.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"low-privileged remote attacker gains elevated privileges on the management appliance","analyst_note":"Find the Dell security advisory for CVE-2026-90717 to get the fixed version numbers and confirm the attack prerequisites.","how_to_check":"- Check the installed Data Domain Management Center version against the affected ranges in the Dell advisory (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20)\n- Confirm the version from the appliance management interface or the Dell support bundle; exact commands unknown","needs_analyst":true,"not_affected_if":["version-outside-affected-ranges"],"who_is_affected":"Teams running Dell PowerProtect Data Domain Management Center in the affected release lines, especially where low-privileged users or remote access to the management interface exist. Sites on versions outside the listed ranges, or without remote access to the appliance, are less exposed; the sources do not say more.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000687,"input_tokens":3435,"output_tokens":686,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-90717':17A,20A '7.13.1.0':84C '7.13.1.80':86C '7.7.1.0':78C '8.3.1.0':90C '8.3.1.40':92C '8.6.1.0':96C '8.6.1.20':98C '8.8':80C 'access':112C 'affect':63B 'attack':52B,109C 'authent':7A,39B,101C 'backup':21B 'bypass':8A,40B,102C 'center':6A,36B,74C 'contain':99C 'could':53B,62B,113C,125C 'cve':15A,18A 'data':3A,23B,33B,66B,71C,129C 'data-domain':22B 'dell':1A,25B,31B,69C 'domain':4A,24B,34B,67B,72C,130C 'elev':57B,120C 'escal':14A 'exploit':54B,115C 'featur':75C 'flaw':61B 'host':30B 'impact':126C 'infrastructur':26B 'lead':118C 'let':9A 'line':46B 'low':11A,49B,107C 'low-privileg':10A,48B 'lts2024':81C 'lts2025':87C 'lts2026':93C 'manag':5A,35B,65B,73C,128C 'potenti':114C 'powerprotect':2A,27B,32B,70C 'privileg':12A,50B,58B,108C,122C 'releas':45B,76C,82C,88C,94C 'remot':51B,111C 'self':29B 'self-host':28B 'sever':44B 'spoof':42B,104C 'system':68B,131C 'user':13A 'version':77C,83C,89C,95C 'vulner':105C,117C,124C","nicknames":[],"mitigations":[],"who_affected":"Teams running Dell PowerProtect Data Domain Management Center in the affected release lines, especially where low-privileged users or remote access to the management interface exist. Sites on versions outside the listed ranges, or without remote access to the appliance, are less exposed; the sources do not say more.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90717","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90717","severity":null,"published_at":"2026-10-28T09:17:08+00:00","modified_at":"2026-10-28T09:17:08+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","fetched_at":"2026-10-28T09:32:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}