{"id":"CVE-2026-90726","kind":"vulnerability","aliases":["CVE-2026-90726"],"related":[],"title":"Dell PowerProtect Data Domain: path traversal lets a privileged local user cause denial of service","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.","summary":"Several Dell PowerProtect Data Domain release lines contain a path traversal flaw. A high-privileged attacker with local access could exploit it to cause a denial of service.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup-appliance","data-domain","dell","infrastructure","powerprotect"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Data Domain OS release against the affected ranges in the Dell advisory: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20\n- Review which accounts hold high privileges on the appliance\n- The sources do not give a specific command for checking the version","fix":"- Move Data Domain OS to a release fixed by Dell; the sources do not name the fixed version numbers, so check the Dell security advisory\n- Limit high-privilege and local shell access to the appliance until patched","status":"open","published_at":"2026-10-27T14:17:04+00:00","first_seen_at":"2026-10-27T14:32:26+00:00","triaged_at":"2026-10-27T14:33:09+00:00","updated_at":"2026-10-27T14:33:09+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T14:33:09Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain OS to a release fixed by Dell; the sources do not name the fixed version numbers, so check the Dell security advisory\n- Limit high-privilege and local shell access to the appliance until patched","reach":"local","title":"Dell PowerProtect Data Domain: path traversal lets a privileged local user cause denial of service","impact":"low","summary":"Several Dell PowerProtect Data Domain release lines contain a path traversal flaw. A high-privileged attacker with local access could exploit it to cause a denial of service.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with privileged local access crashes the appliance, disrupting backups","analyst_note":"Find the fixed Data Domain OS versions and the official Dell advisory for CVE-2026-90726; the NVD entry alone does not name them.","how_to_check":"- Check the installed Data Domain OS release against the affected ranges in the Dell advisory: Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20\n- Review which accounts hold high privileges on the appliance\n- The sources do not give a specific command for checking the version","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Organizations running Dell PowerProtect Data Domain appliances in the listed release ranges. The attacker must already hold high privileges with local access, so exposure depends on who has administrative access to the appliance.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":3405,"output_tokens":642,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-90726':18A,21A '7.13.1.0':73C '7.13.1.80':75C '7.7.1.0':67C '8.3.1.0':79C '8.3.1.40':81C '8.6.1.0':85C '8.6.1.20':87C '8.8':69C 'access':50B,99C 'applianc':24B 'attack':47B,96C 'backup':23B 'backup-appli':22B 'caus':12A,55B 'contain':38B,88C 'could':51B,100C 'cve':16A,19A 'data':3A,26B,34B,62C 'data-domain':25B 'dell':1A,28B,32B,60C 'denial':13A,57B,107C 'domain':4A,27B,35B,63C 'exploit':52B,102C 'featur':64C 'flaw':42B 'high':45B,94C 'high-privileg':44B 'infrastructur':29B 'lead':105C 'let':7A 'line':37B 'local':10A,49B,98C 'lts2024':70C 'lts2025':76C 'lts2026':82C 'path':5A,40B,90C 'potenti':101C 'powerprotect':2A,30B,33B,61C 'privileg':9A,46B,95C 'releas':36B,65C,71C,77C,83C 'servic':15A,59B,109C 'sever':31B 'travers':6A,41B,91C 'user':11A 'version':66C,72C,78C,84C 'vulner':92C,104C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Dell PowerProtect Data Domain appliances in the listed release ranges. The attacker must already hold high privileges with local access, so exposure depends on who has administrative access to the appliance.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90726","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90726","severity":null,"published_at":"2026-10-27T14:17:04+00:00","modified_at":"2026-10-27T14:17:04+00:00","first_seen_at":"2026-10-27T14:32:26+00:00","fetched_at":"2026-10-27T14:32:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}