{"id":"CVE-2026-90728","kind":"vulnerability","aliases":["CVE-2026-90728"],"related":[],"title":"Dell PowerProtect Data Domain: local high-privilege user can escalate privileges","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.","summary":"Several release lines of Dell PowerProtect Data Domain contain an improper privilege management flaw. A high-privileged local attacker could use it to gain higher privileges on the appliance.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup-appliance","data-domain","dell","powerprotect","vendor"],"not_affected_if":["no-high-privilege-local-accounts","versions-outside-listed-ranges"],"how_to_check":"- Check the installed Data Domain OS version against the affected ranges: Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20.\n- Review which accounts hold high-privilege local access to the appliance.","fix":"- Move Data Domain OS to a fixed release from Dell's advisory for CVE-2026-90728 (unknown: the sources do not name the fixed version).\n- Restrict high-privilege local accounts to the people who need them.","status":"open","published_at":"2026-10-27T12:17:08+00:00","first_seen_at":"2026-10-27T12:31:38+00:00","triaged_at":"2026-10-27T12:32:06+00:00","updated_at":"2026-10-27T12:32:06+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-27T12:32:06Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain OS to a fixed release from Dell's advisory for CVE-2026-90728 (unknown: the sources do not name the fixed version).\n- Restrict high-privilege local accounts to the people who need them.","reach":"local","title":"Dell PowerProtect Data Domain: local high-privilege user can escalate privileges","impact":"medium","summary":"Several release lines of Dell PowerProtect Data Domain contain an improper privilege management flaw. A high-privileged local attacker could use it to gain higher privileges on the appliance.","category":"vendor","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with high local privileges gains elevated appliance privileges.","analyst_note":"Find Dell's advisory for CVE-2026-90728 to confirm the fixed release versions and any workaround; the NVD entry gives only the affected ranges.","how_to_check":"- Check the installed Data Domain OS version against the affected ranges: Feature Release 7.7.1.0 through 8.7, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20.\n- Review which accounts hold high-privilege local access to the appliance.","needs_analyst":true,"not_affected_if":["versions-outside-listed-ranges","no-high-privilege-local-accounts"],"who_is_affected":"Organizations running Dell PowerProtect Data Domain appliances on one of the listed release ranges. Exposure requires an attacker who already holds high privileges with local access, so the risk sits mainly with administrators and shared accounts.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000671,"input_tokens":3410,"output_tokens":660,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-90728':15A,18A '7.13.1.0':71C '7.13.1.80':73C '7.7.1.0':65C '8.3.1.0':77C '8.3.1.40':79C '8.6.1.0':83C '8.6.1.20':85C '8.7':67C 'access':98C 'applianc':21B,57B 'attack':47B,95C 'backup':20B 'backup-appli':19B 'contain':36B,86C 'could':48B,99C 'cve':13A,16A 'data':3A,23B,34B,60C 'data-domain':22B 'dell':1A,25B,32B,58C 'domain':4A,24B,35B,61C 'elev':106C 'escal':11A 'exploit':101C 'featur':62C 'flaw':41B 'gain':52B 'high':7A,44B,93C 'high-privileg':6A,43B 'higher':53B 'improp':38B,88C 'lead':104C 'line':30B 'local':5A,46B,97C 'lts2024':68C 'lts2025':74C 'lts2026':80C 'manag':40B,90C 'potenti':100C 'powerprotect':2A,26B,33B,59C 'privileg':8A,12A,39B,45B,54B,89C,94C,108C 'releas':29B,63C,69C,75C,81C 'sever':28B 'use':49B 'user':9A 'vendor':27B 'version':64C,70C,76C,82C 'vulner':91C,103C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Dell PowerProtect Data Domain appliances on one of the listed release ranges. Exposure requires an attacker who already holds high privileges with local access, so the risk sits mainly with administrators and shared accounts.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T12:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90728","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90728","severity":null,"published_at":"2026-10-27T12:17:08+00:00","modified_at":"2026-10-27T12:17:08+00:00","first_seen_at":"2026-10-27T12:31:38+00:00","fetched_at":"2026-10-27T12:31:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}