{"id":"CVE-2026-90732","kind":"vulnerability","aliases":["CVE-2026-90732"],"related":[],"title":"Dell PowerProtect Data Domain: stack buffer overflow lets a privileged user crash service","description":"Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.","summary":"Several Dell PowerProtect Data Domain release lines contain a stack-based buffer overflow. A high-privileged remote attacker could exploit it to cause a denial of service.","severity":"medium","cvss":4.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup-appliance","data-domain","dell","infrastructure","powerprotect"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Data Domain OS version (for example with the system show version command on the appliance) against the affected ranges: 7.7.1.0 through LTS 2026, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20.","fix":"- Move Data Domain OS to a release that is newer than the affected ranges listed for your line, as published in Dell's security advisory (exact fixed versions: unknown from these sources).","status":"open","published_at":"2026-10-27T12:17:08+00:00","first_seen_at":"2026-10-27T12:31:38+00:00","triaged_at":"2026-10-27T12:32:15+00:00","updated_at":"2026-10-27T12:32:15+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-27T12:32:15Z","model":"claude-haiku-5-5","output":{"fix":"- Move Data Domain OS to a release that is newer than the affected ranges listed for your line, as published in Dell's security advisory (exact fixed versions: unknown from these sources).","reach":"network","title":"Dell PowerProtect Data Domain: stack buffer overflow lets a privileged user crash service","impact":"low","summary":"Several Dell PowerProtect Data Domain release lines contain a stack-based buffer overflow. A high-privileged remote attacker could exploit it to cause a denial of service.","category":"infrastructure","nicknames":[],"who_cares":["dell","powerprotect","data-domain","backup-appliance"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker with high privileges crashes the appliance through remote access","analyst_note":"Find the Dell security advisory for this CVE to confirm the fixed versions and the exact privilege and remote-access requirements.","how_to_check":"- Check the installed Data Domain OS version (for example with the system show version command on the appliance) against the affected ranges: 7.7.1.0 through LTS 2026, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Owners of Dell PowerProtect Data Domain appliances running the listed Feature Release, LTS2024, LTS2025 or LTS2026 versions, where remote administrative access is reachable. Appliances on other versions, or not exposed to remote management networks, are less likely to be affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000643,"input_tokens":3417,"output_tokens":603,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-90732':16A,19A '2026':68C '7.13.1.0':72C '7.13.1.80':74C '7.7.1.0':65C '8.3.1.0':78C '8.3.1.40':80C '8.6.1.0':84C '8.6.1.20':86C 'access':101C 'applianc':22B 'attack':48B,98C 'backup':21B 'backup-appli':20B 'base':40B,91C 'buffer':6A,41B,92C 'caus':53B 'contain':36B,87C 'could':49B,102C 'crash':12A 'cve':14A,17A 'data':3A,24B,32B,60C 'data-domain':23B 'dell':1A,26B,30B,58C 'denial':55B,109C 'domain':4A,25B,33B,61C 'exploit':50B,104C 'featur':62C 'high':45B,96C 'high-privileg':44B 'infrastructur':27B 'lead':107C 'let':8A 'line':35B 'lts':67C 'lts2024':69C 'lts2025':75C 'lts2026':81C 'overflow':7A,42B,93C 'potenti':103C 'powerprotect':2A,28B,31B,59C 'privileg':10A,46B,97C 'releas':34B,63C,70C,76C,82C 'remot':47B,100C 'servic':13A,57B,111C 'sever':29B 'stack':5A,39B,90C 'stack-bas':38B,89C 'user':11A 'version':64C,71C,77C,83C 'vulner':94C,106C","nicknames":[],"mitigations":[],"who_affected":"Owners of Dell PowerProtect Data Domain appliances running the listed Feature Release, LTS2024, LTS2025 or LTS2026 versions, where remote administrative access is reachable. Appliances on other versions, or not exposed to remote management networks, are less likely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T12:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security_alert@emc.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90732","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90732","severity":null,"published_at":"2026-10-27T12:17:08+00:00","modified_at":"2026-10-27T12:17:08+00:00","first_seen_at":"2026-10-27T12:31:38+00:00","fetched_at":"2026-10-27T12:31:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}