Description
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability could impact other managed Data Domain systems.
Published: 2026-10-28
Score: 9.1 Critical
EPSS: n/a
KEV: No
Impact: Privilege Escalation via Authentication Bypass
Action: Immediate Patch
AI Analysis

Impact

Dell PowerProtect Data Domain Management Center is vulnerable to an authentication bypass that allows a low‑privileged attacker with remote access to spoof credentials and obtain administrative privileges. The flaw can lead to elevation of privileges and may affect other managed Data Domain systems. The vulnerability is classified as CWE‑290 (Improper Authentication).

Affected Systems

The affected products are Dell PowerProtect Data Domain Management Center. Affected versions include Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20.

Risk and Exploitability

The CVSS score of 9.1 indicates a high severity, and the EPSS score is currently unavailable, which means the public risk data does not specify the current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote network access by a low‑privileged user, and the attacker could spoof authentication tokens to gain administrative control. Such exploitation could enable further attacks against the broader Data Domain deployment.

Generated by OpenCVE AI on October 28, 2026 at 10:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Dell’s security update for PowerProtect Data Domain Management Center as detailed in the official KB article (https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities).
  • Restrict remote access to the Management Center to trusted IP ranges and enforce strict firewall rules to limit the attack surface.
  • Enable multi‑factor authentication or certificate‑based authentication on the Management Center to mitigate credential spoofing and reduce the risk of unauthorized elevation.

Generated by OpenCVE AI on October 28, 2026 at 10:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
Title Authentication Bypass by Spoofing in Dell PowerProtect Data Domain Management Center

Wed, 28 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability could impact other managed Data Domain systems.
Weaknesses CWE-290
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-10-28T08:42:53.657Z

Reserved: 2026-09-13T10:04:17.591Z

Link: CVE-2026-90717

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T09:17:08.297

Modified: 2026-10-28T09:17:08.297

Link: CVE-2026-90717

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T10:30:18Z

Weaknesses
  • CWE-290

    Authentication Bypass by Spoofing