Description
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Published: 2026-10-28
Score: 2.7 Low
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an SQL injection that occurs when user input is improperly neutralized within an SQL command. An attacker with high privileges and remote access can exploit this weakness to run arbitrary SQL queries, potentially revealing sensitive system information. This flaw is categorized as CWE‑89.

Affected Systems

The affected product is Dell PowerProtect Data Domain Management Center. Vulnerable versions include Feature Release builds from 7.7.1.0 to 8.8, LTS2024 builds from 7.13.1.0 to 7.13.1.80, LTS2025 builds from 8.3.1.0 to 8.3.1.40, and LTS2026 builds from 8.6.1.0 to 8.6.1.20.

Risk and Exploitability

The CVSS score of 2.7 indicates a low overall severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. The attack requires a user with high privileged credentials and remote access to the management interface. Because the flaw could lead to disclosure of configuration or data, organizations should assess the exposure of the management interface and apply the Dell security advisory’s patch as soon as possible.

Generated by OpenCVE AI on October 28, 2026 at 09:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Dell PowerProtect Data Domain Management Center patch outlined in the Dell Security Advisory.
  • Restrict network access to the management interface to trusted IP addresses or VPN only.
  • Enforce least‑privilege for administrative accounts and monitor for suspicious SQL activity.

Generated by OpenCVE AI on October 28, 2026 at 09:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 09:45:00 +0000

Type Values Removed Values Added
Title SQL Injection in Dell PowerProtect Data Domain Management Center Leads to Information Disclosure

Wed, 28 Oct 2026 08:30:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Weaknesses CWE-89
References
Metrics cvssV3_1

{'score': 2.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-10-28T08:20:39.490Z

Reserved: 2026-09-13T10:04:17.592Z

Link: CVE-2026-90724

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T09:17:08.930

Modified: 2026-10-28T09:17:08.930

Link: CVE-2026-90724

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T09:30:20Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')