{"id":"CVE-2026-90724","kind":"vulnerability","aliases":["CVE-2026-90724"],"related":[],"title":"Dell PowerProtect Data Domain Management Center: SQL injection leaks information to privileged users","description":"Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.","summary":"Several Dell PowerProtect Data Domain Management Center release lines contain an SQL injection flaw in their database query handling. A high-privileged attacker with remote access could read information from the backing database.","severity":"low","cvss":2.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","data-domain","dell","infrastructure","powerprotect","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed Management Center version against the affected ranges in the Dell advisory (unknown whether the sources list exact fixed builds)\n- Confirm which release line is deployed: Feature Release 7.7.1.0 to 8.8, LTS2024 7.13.1.0 to 7.13.1.80, LTS2025 8.3.1.0 to 8.3.1.40, LTS2026 8.6.1.0 to 8.6.1.20","fix":"- Move Data Domain Management Center to a fixed release from Dell's advisory (unknown in the sources)","status":"open","published_at":"2026-10-28T09:17:08+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","triaged_at":"2026-10-28T09:34:08+00:00","updated_at":"2026-10-28T09:34:08+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T09:34:08Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain Management Center to a fixed release from Dell's advisory (unknown in the sources)","reach":"network","title":"Dell PowerProtect Data Domain Management Center: SQL injection leaks information to privileged users","impact":"low","summary":"Several Dell PowerProtect Data Domain Management Center release lines contain an SQL injection flaw in their database query handling. A high-privileged attacker with remote access could read information from the backing database.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"high-privileged attacker reads database contents remotely","analyst_note":"Find Dell's advisory for CVE-2026-90724 to get the fixed builds and confirm the affected release list.","how_to_check":"- Check the installed Management Center version against the affected ranges in the Dell advisory (unknown whether the sources list exact fixed builds)\n- Confirm which release line is deployed: Feature Release 7.7.1.0 to 8.8, LTS2024 7.13.1.0 to 7.13.1.80, LTS2025 8.3.1.0 to 8.3.1.40, LTS2026 8.6.1.0 to 8.6.1.20","needs_analyst":true,"not_affected_if":["auth-required","default-config"],"who_is_affected":"Teams running Dell PowerProtect Data Domain Management Center in the listed release ranges are exposed. The attacker must already hold high privileges and reach the management interface remotely. Sites on other products or on releases outside these ranges can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000646,"input_tokens":3429,"output_tokens":606,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-90724':16A,19A '7.13.1.0':79C '7.13.1.80':81C '7.7.1.0':73C '8.3.1.0':85C '8.3.1.40':87C '8.6.1.0':91C '8.6.1.20':93C '8.8':75C 'access':56B,115C 'attack':53B,112C 'back':62B 'backup':20B 'center':6A,36B,69C 'command':105C 'contain':39B,94C 'could':57B,116C 'cve':14A,17A 'data':3A,22B,33B,66C 'data-domain':21B 'databas':46B,63B 'dell':1A,24B,31B,64C 'disclosur':124C 'domain':4A,23B,34B,67C 'element':100C 'exploit':118C 'featur':70C 'flaw':43B 'handl':48B 'high':51B,110C 'high-privileg':50B 'host':29B 'improp':96C 'inform':10A,59B,123C 'infrastructur':25B 'inject':8A,42B,107C 'lead':121C 'leak':9A 'line':38B 'lts2024':76C 'lts2025':82C 'lts2026':88C 'manag':5A,35B,68C 'neutral':97C 'potenti':117C 'powerprotect':2A,26B,32B,65C 'privileg':12A,52B,111C 'queri':47B 'read':58B 'releas':37B,71C,77C,83C,89C 'remot':55B,114C 'self':28B 'self-host':27B 'sever':30B 'special':99C 'sql':7A,41B,104C,106C 'use':101C 'user':13A 'version':72C,78C,84C,90C 'vulner':108C,120C","nicknames":[],"mitigations":[],"who_affected":"Teams running Dell PowerProtect Data Domain Management Center in the listed release ranges are exposed. The attacker must already hold high privileges and reach the management interface remotely. Sites on other products or on releases outside these ranges can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T09:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90724","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90724","severity":null,"published_at":"2026-10-28T09:17:08+00:00","modified_at":"2026-10-28T09:17:08+00:00","first_seen_at":"2026-10-28T09:32:03+00:00","fetched_at":"2026-10-28T09:32:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}