Description
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Published: 2026-10-28
Score: 2.7 Low
EPSS: n/a
KEV: No
Impact: Information disclosure via SQL injection
Action: Patch
AI Analysis

Impact

The vulnerability is an instance of SQL Injection where malicious input is not properly neutralized in SQL commands used by the Dell PowerProtect Data Domain Management Center. A high privileged attacker who obtains remote access can manipulate queries to read sensitive data, potentially exposing confidential information about the data domain system and stored archives.

Affected Systems

This flaw affects Dell PowerProtect Data Domain Management Center Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, and LTS2026 release versions 8.6.1.0 through 8.6.1.20.

Risk and Exploitability

The CVSS score of 2.7 indicates a low severity vulnerability, and the EPSS score is not available. This vulnerability is not listed in the CISA KEV catalog. Exploitation requires both remote access to the Management Center and high level privileges, making the attack vector limited to privileged users. Consequently, the overall risk remains low, but the presence of a SQL injection flaw warrants prompt remediation.

Generated by OpenCVE AI on October 28, 2026 at 09:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Dell PowerProtect Data Domain Management Center security update that addresses the SQL injection flaw.
  • Restrict remote access to the Management Center to trusted network segments or VPN endpoints.
  • Enforce the principle of least privilege by limiting the administrative rights of users who interact with the Management Center to only those necessary for their role.

Generated by OpenCVE AI on October 28, 2026 at 09:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-10-28T08:36:16.969Z

Reserved: 2026-09-13T10:04:17.591Z

Link: CVE-2026-90719

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T09:17:08.423

Modified: 2026-10-28T09:17:08.423

Link: CVE-2026-90719

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T09:30:20Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')