{"id":"CVE-2026-90730","kind":"vulnerability","aliases":["CVE-2026-90730"],"related":[],"title":"Dell PowerProtect Data Domain: improper access control allows remote denial of service","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.","summary":"Several Dell PowerProtect Data Domain release lines contain an improper access control flaw. An unauthenticated attacker with remote access could potentially cause a denial of service.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup-appliances","data-domain","dell","infrastructure","powerprotect"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Data Domain OS version in the system's management interface or with the product's version command; affected ranges are Feature Release `7.7.1.0` through `8.7`, LTS2024 `7.13.1.0` through `7.13.1.80`, LTS2025 `8.3.1.0` through `8.3.1.40`, and LTS2026 `8.6.1.0` through `8.6.1.20`.\n- Confirm whether the management or remote access interfaces are reachable from untrusted networks.","fix":"- Move Dell PowerProtect Data Domain to a fixed release listed in Dell's advisory for this CVE (the sources do not name the fixed versions).\n- Restrict network access to the Data Domain management interface until patched.","status":"open","published_at":"2026-10-27T12:17:08+00:00","first_seen_at":"2026-10-27T12:31:38+00:00","triaged_at":"2026-10-27T12:32:06+00:00","updated_at":"2026-10-27T12:32:06+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T12:32:06Z","model":"claude-haiku-5-5","output":{"fix":"- Move Dell PowerProtect Data Domain to a fixed release listed in Dell's advisory for this CVE (the sources do not name the fixed versions).\n- Restrict network access to the Data Domain management interface until patched.","reach":"internet","title":"Dell PowerProtect Data Domain: improper access control allows remote denial of service","impact":"low","summary":"Several Dell PowerProtect Data Domain release lines contain an improper access control flaw. An unauthenticated attacker with remote access could potentially cause a denial of service.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup-appliances"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker causes the backup appliance to stop serving requests.","analyst_note":"Check Dell's security advisory for CVE-2026-90730 for the fixed versions and whether remote access is required; the NVD text alone does not name them.","how_to_check":"- Check the installed Data Domain OS version in the system's management interface or with the product's version command; affected ranges are Feature Release `7.7.1.0` through `8.7`, LTS2024 `7.13.1.0` through `7.13.1.80`, LTS2025 `8.3.1.0` through `8.3.1.40`, and LTS2026 `8.6.1.0` through `8.6.1.20`.\n- Confirm whether the management or remote access interfaces are reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Operators of Dell PowerProtect Data Domain appliances on the affected release lines that accept remote access. Systems on the listed versions that are not reachable from untrusted networks are at lower practical risk. Systems on unaffected versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":3408,"output_tokens":662,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-90730':15A,18A '7.13.1.0':67C '7.13.1.80':69C '7.7.1.0':61C '8.3.1.0':73C '8.3.1.40':75C '8.6.1.0':79C '8.6.1.20':81C '8.7':63C 'access':6A,38B,46B,85C,93C 'allow':8A 'applianc':21B 'attack':43B,90C 'backup':20B 'backup-appli':19B 'caus':49B 'contain':35B,82C 'control':7A,39B,86C 'could':47B,94C 'cve':13A,16A 'data':3A,23B,31B,56C 'data-domain':22B 'dell':1A,25B,29B,54C 'denial':10A,51B,101C 'domain':4A,24B,32B,57C 'exploit':96C 'featur':58C 'flaw':40B 'improp':5A,37B,84C 'infrastructur':26B 'lead':99C 'line':34B 'lts2024':64C 'lts2025':70C 'lts2026':76C 'potenti':48B,95C 'powerprotect':2A,27B,30B,55C 'releas':33B,59C,65C,71C,77C 'remot':9A,45B,92C 'servic':12A,53B,103C 'sever':28B 'unauthent':42B,89C 'version':60C,66C,72C,78C 'vulner':87C,98C","nicknames":[],"mitigations":[],"who_affected":"Operators of Dell PowerProtect Data Domain appliances on the affected release lines that accept remote access. Systems on the listed versions that are not reachable from untrusted networks are at lower practical risk. Systems on unaffected versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T12:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90730","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90730","severity":null,"published_at":"2026-10-27T12:17:08+00:00","modified_at":"2026-10-27T12:17:08+00:00","first_seen_at":"2026-10-27T12:31:38+00:00","fetched_at":"2026-10-27T12:31:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}