{"id":"CVE-2026-90727","kind":"vulnerability","aliases":["CVE-2026-90727"],"related":[],"title":"Dell PowerProtect Data Domain: relative path traversal allows information tampering","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Relative Path Traversal vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.","summary":"Several Dell PowerProtect Data Domain release lines contain a relative path traversal flaw. A high-privileged attacker with remote access could use it to tamper with information on the appliance.","severity":"low","cvss":3.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","data-domain","dell","infrastructure","powerprotect","storage"],"not_affected_if":["no-remote-access","unaffected-version"],"how_to_check":"- Check the installed Data Domain OS version against the affected ranges listed in the advisory (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20)\n- Confirm the exact installed version with the Data Domain system's version command (unknown exact command from sources)","fix":"- Move Data Domain to a fixed release from Dell's advisory for your release line (exact fixed versions: unknown from sources)\n- Restrict remote administrative access to trusted management networks until patched","status":"open","published_at":"2026-10-27T14:17:04+00:00","first_seen_at":"2026-10-27T14:32:26+00:00","triaged_at":"2026-10-27T14:33:19+00:00","updated_at":"2026-10-27T14:33:19+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T14:33:19Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain to a fixed release from Dell's advisory for your release line (exact fixed versions: unknown from sources)\n- Restrict remote administrative access to trusted management networks until patched","reach":"network","title":"Dell PowerProtect Data Domain: relative path traversal allows information tampering","impact":"low","summary":"Several Dell PowerProtect Data Domain release lines contain a relative path traversal flaw. A high-privileged attacker with remote access could use it to tamper with information on the appliance.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup","storage"],"confidence":0.6,"needs_auth":"yes","worst_case":"High-privileged remote user alters information on the appliance","analyst_note":"Find Dell's security advisory for CVE-2026-90727 to confirm fixed versions and the exact CVSS vector; the NVD entry alone gives no fix.","how_to_check":"- Check the installed Data Domain OS version against the affected ranges listed in the advisory (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20)\n- Confirm the exact installed version with the Data Domain system's version command (unknown exact command from sources)","needs_analyst":true,"not_affected_if":["unaffected-version","no-remote-access"],"who_is_affected":"Organizations running Dell PowerProtect Data Domain appliances in the listed version ranges. The attacker must already hold high privileges and have remote access, so exposure is mainly the management interface reachable from less-trusted networks. Systems on unaffected versions or without remote access can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000674,"input_tokens":3408,"output_tokens":666,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-90727':13A,16A '7.13.1.0':69C '7.13.1.80':71C '7.7.1.0':63C '8.3.1.0':75C '8.3.1.40':77C '8.6.1.0':81C '8.6.1.20':83C '8.8':65C 'access':45B,96C 'allow':8A 'applianc':55B 'attack':42B,93C 'backup':17B 'contain':32B,84C 'could':46B,97C 'cve':11A,14A 'data':3A,19B,28B,58C 'data-domain':18B 'dell':1A,21B,26B,56C 'domain':4A,20B,29B,59C 'exploit':99C 'featur':60C 'flaw':37B 'high':40B,91C 'high-privileg':39B 'inform':9A,52B,104C 'infrastructur':22B 'lead':102C 'line':31B 'lts2024':66C 'lts2025':72C 'lts2026':78C 'path':6A,35B,87C 'potenti':98C 'powerprotect':2A,23B,27B,57C 'privileg':41B,92C 'relat':5A,34B,86C 'releas':30B,61C,67C,73C,79C 'remot':44B,95C 'sever':25B 'storag':24B 'tamper':10A,50B,105C 'travers':7A,36B,88C 'use':47B 'version':62C,68C,74C,80C 'vulner':89C,101C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Dell PowerProtect Data Domain appliances in the listed version ranges. The attacker must already hold high privileges and have remote access, so exposure is mainly the management interface reachable from less-trusted networks. Systems on unaffected versions or without remote access can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90727","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90727","severity":null,"published_at":"2026-10-27T14:17:04+00:00","modified_at":"2026-10-27T14:17:04+00:00","first_seen_at":"2026-10-27T14:32:26+00:00","fetched_at":"2026-10-27T14:32:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}