{"id":"CVE-2026-90719","kind":"vulnerability","aliases":["CVE-2026-90719"],"related":[],"title":"Dell PowerProtect Data Domain Management Center: SQL injection leaks information to admins","description":"Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.","summary":"Several Dell PowerProtect Data Domain Management Center release lines contain an SQL injection flaw. A high-privileged attacker with remote access could read information from the backend database.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","data-domain","dell","infrastructure","powerprotect"],"not_affected_if":["no-remote-admin-access","unaffected-version"],"how_to_check":"- Check the installed Management Center version against the affected ranges in the Dell advisory (unknown exact fixed builds in the sources)\n- Confirm which release line is in use: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, or LTS2026 8.6.1.0 through 8.6.1.20","fix":"- Move to a fixed Dell PowerProtect Data Domain Management Center release for your line; the fixed version numbers are unknown in the sources\n- Restrict administrative access to the management interface until patched","status":"open","published_at":"2026-10-28T09:17:08+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","triaged_at":"2026-10-28T09:34:11+00:00","updated_at":"2026-10-28T09:34:11+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T09:34:11Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed Dell PowerProtect Data Domain Management Center release for your line; the fixed version numbers are unknown in the sources\n- Restrict administrative access to the management interface until patched","reach":"network","title":"Dell PowerProtect Data Domain Management Center: SQL injection leaks information to admins","impact":"low","summary":"Several Dell PowerProtect Data Domain Management Center release lines contain an SQL injection flaw. A high-privileged attacker with remote access could read information from the backend database.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup","infrastructure"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with high privileges reads database information","analyst_note":"Check Dell's security advisory for the fixed builds per release line and whether the flaw is reachable beyond the admin role.","how_to_check":"- Check the installed Management Center version against the affected ranges in the Dell advisory (unknown exact fixed builds in the sources)\n- Confirm which release line is in use: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, or LTS2026 8.6.1.0 through 8.6.1.20","needs_analyst":true,"not_affected_if":["unaffected-version","no-remote-admin-access"],"who_is_affected":"Organizations running the affected Dell PowerProtect Data Domain Management Center release lines with remote access to the management interface. Systems on unaffected versions or with no remote administrative access face lower exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000652,"input_tokens":3429,"output_tokens":619,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-90719':15A,18A '7.13.1.0':70C '7.13.1.80':72C '7.7.1.0':64C '8.3.1.0':76C '8.3.1.40':78C '8.6.1.0':82C '8.6.1.20':84C '8.8':66C 'access':47B,106C 'admin':12A 'attack':44B,103C 'backend':53B 'backup':19B 'center':6A,32B,60C 'command':96C 'contain':35B,85C 'could':48B,107C 'cve':13A,16A 'data':3A,21B,29B,57C 'data-domain':20B 'databas':54B 'dell':1A,23B,27B,55C 'disclosur':115C 'domain':4A,22B,30B,58C 'element':91C 'exploit':109C 'featur':61C 'flaw':39B 'high':42B,101C 'high-privileg':41B 'improp':87C 'inform':10A,50B,114C 'infrastructur':24B 'inject':8A,38B,98C 'lead':112C 'leak':9A 'line':34B 'lts2024':67C 'lts2025':73C 'lts2026':79C 'manag':5A,31B,59C 'neutral':88C 'potenti':108C 'powerprotect':2A,25B,28B,56C 'privileg':43B,102C 'read':49B 'releas':33B,62C,68C,74C,80C 'remot':46B,105C 'sever':26B 'special':90C 'sql':7A,37B,95C,97C 'use':92C 'version':63C,69C,75C,81C 'vulner':99C,111C","nicknames":[],"mitigations":[],"who_affected":"Organizations running the affected Dell PowerProtect Data Domain Management Center release lines with remote access to the management interface. Systems on unaffected versions or with no remote administrative access face lower exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90719","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90719","severity":null,"published_at":"2026-10-28T09:17:08+00:00","modified_at":"2026-10-28T09:17:08+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","fetched_at":"2026-10-28T09:32:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}