{"id":"CVE-2026-90723","kind":"vulnerability","aliases":["CVE-2026-90723"],"related":[],"title":"Dell PowerProtect Data Domain Management Center: SQL injection leaks information to privileged users","description":"Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.","summary":"Several Dell PowerProtect Data Domain Management Center release lines contain an SQL injection flaw. A high-privileged attacker with remote access could read information from the backend database.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","data-domain","dell","infrastructure","powerprotect","self-hosted"],"not_affected_if":["restricted-admin-access","unaffected-version"],"how_to_check":"- Check the installed Management Center version against the affected ranges in the Dell advisory (unknown: the sources list ranges but no check command)\n- Confirm which release line is deployed: Feature Release 7.7.1.0 to 8.8, LTS2024 7.13.1.0 to 7.13.1.80, LTS2025 8.3.1.0 to 8.3.1.40, LTS2026 8.6.1.0 to 8.6.1.20","fix":"- Move to a fixed Dell PowerProtect Data Domain Management Center release for your line (the fixed version numbers are unknown from the sources)\n- Check the Dell security advisory for the patched build","status":"open","published_at":"2026-10-28T09:17:08+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","triaged_at":"2026-10-28T09:34:09+00:00","updated_at":"2026-10-28T09:34:09+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T09:34:09Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a fixed Dell PowerProtect Data Domain Management Center release for your line (the fixed version numbers are unknown from the sources)\n- Check the Dell security advisory for the patched build","reach":"network","title":"Dell PowerProtect Data Domain Management Center: SQL injection leaks information to privileged users","impact":"low","summary":"Several Dell PowerProtect Data Domain Management Center release lines contain an SQL injection flaw. A high-privileged attacker with remote access could read information from the backend database.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with high privileges reads database information","analyst_note":"Find the Dell advisory for CVE-2026-90723 to confirm fixed versions and the exact information exposed.","how_to_check":"- Check the installed Management Center version against the affected ranges in the Dell advisory (unknown: the sources list ranges but no check command)\n- Confirm which release line is deployed: Feature Release 7.7.1.0 to 8.8, LTS2024 7.13.1.0 to 7.13.1.80, LTS2025 8.3.1.0 to 8.3.1.40, LTS2026 8.6.1.0 to 8.6.1.20","needs_analyst":true,"not_affected_if":["unaffected-version","restricted-admin-access"],"who_is_affected":"Teams running Dell PowerProtect Data Domain Management Center in the listed Feature Release or LTS version ranges. The attacker needs high privileges and remote access, so teams that restrict admin accounts and management network access carry less risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000659,"input_tokens":3429,"output_tokens":632,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-90723':16A,19A '7.13.1.0':74C '7.13.1.80':76C '7.7.1.0':68C '8.3.1.0':80C '8.3.1.40':82C '8.6.1.0':86C '8.6.1.20':88C '8.8':70C 'access':51B,110C 'attack':48B,107C 'backend':57B 'backup':20B 'center':6A,36B,64C 'command':100C 'contain':39B,89C 'could':52B,111C 'cve':14A,17A 'data':3A,22B,33B,61C 'data-domain':21B 'databas':58B 'dell':1A,24B,31B,59C 'disclosur':119C 'domain':4A,23B,34B,62C 'element':95C 'exploit':113C 'featur':65C 'flaw':43B 'high':46B,105C 'high-privileg':45B 'host':29B 'improp':91C 'inform':10A,54B,118C 'infrastructur':25B 'inject':8A,42B,102C 'lead':116C 'leak':9A 'line':38B 'lts2024':71C 'lts2025':77C 'lts2026':83C 'manag':5A,35B,63C 'neutral':92C 'potenti':112C 'powerprotect':2A,26B,32B,60C 'privileg':12A,47B,106C 'read':53B 'releas':37B,66C,72C,78C,84C 'remot':50B,109C 'self':28B 'self-host':27B 'sever':30B 'special':94C 'sql':7A,41B,99C,101C 'use':96C 'user':13A 'version':67C,73C,79C,85C 'vulner':103C,115C","nicknames":[],"mitigations":[],"who_affected":"Teams running Dell PowerProtect Data Domain Management Center in the listed Feature Release or LTS version ranges. The attacker needs high privileges and remote access, so teams that restrict admin accounts and management network access carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90723","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90723","severity":null,"published_at":"2026-10-28T09:17:08+00:00","modified_at":"2026-10-28T09:17:08+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","fetched_at":"2026-10-28T09:32:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}