---
id: "CVE-2026-90730"
kind: "vulnerability"
aliases: ["CVE-2026-90730"]
title: "Dell PowerProtect Data Domain: improper access control allows remote denial of service"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["backup-appliances", "data-domain", "dell", "infrastructure", "powerprotect"]
not_affected_if: ["default-config"]
published_at: "2026-10-27T12:17:08+00:00"
first_seen_at: "2026-10-27T12:31:38+00:00"
updated_at: "2026-10-27T12:32:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90730", "first_seen_at": "2026-10-27T12:31:38+00:00"}]
---

# Dell PowerProtect Data Domain: improper access control allows remote denial of service

Several Dell PowerProtect Data Domain release lines contain an improper access control flaw. An unauthenticated attacker with remote access could potentially cause a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Data Domain OS version in the system's management interface or with the product's version command; affected ranges are Feature Release `7.7.1.0` through `8.7`, LTS2024 `7.13.1.0` through `7.13.1.80`, LTS2025 `8.3.1.0` through `8.3.1.40`, and LTS2026 `8.6.1.0` through `8.6.1.20`.
- Confirm whether the management or remote access interfaces are reachable from untrusted networks.

## Fix

- Move Dell PowerProtect Data Domain to a fixed release listed in Dell's advisory for this CVE (the sources do not name the fixed versions).
- Restrict network access to the Data Domain management interface until patched.

## Timeline

- 2026-10-27T12:31:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90730

## From the sources

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_