Article
Dell Data Domain: Seven Critical Flaws and the Build Each Release Line Needs
Dell's DSA-2026-416 lists seven critical PowerProtect Data Domain flaws, four needing no login. See the fixed DD OS build for each release line.
Read more
Vulnerability
Dell PowerProtect Data Domain Management Center SQL injection (CVE-2026-103792)
An SQL injection in Dell PowerProtect Data Domain Management Center.
- CVE ID
- CVE-2026-103792
- CVSS
- 9.6 Critical (CVSS 3.1, Dell as CNA)
- Affected product
- PowerProtect Data Domain Management Center (with DD OS)
- Exploited
- Unknown
- Published
- 28 October 2026 (CVE record); added to Dell advisory DSA-2026-416 on 19 October 2026
In short
CVE-2026-103792 is an SQL injection in Dell PowerProtect Data Domain Management Center. Dell says a low-privileged remote attacker could gain unauthorized access to managed systems. It is rated 9.6 and fixed in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30.
- CVECVE-2026-103792
- ProductDell PowerProtect Data Domain Management Center (with DD OS)
- Fix Steps5actions listedFind Management Center · Upgrade together
What it allows
Dell describes CVE-2026-103792 as an SQL injection in Data Domain Management Center, listed as an improper neutralization of special elements used in an SQL command. A low-privileged attacker with remote access could potentially exploit it, leading to unauthorized access to managed systems.
Dell, as CNA, scores it 9.6 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. The CVE record lists CWE-89.
What the Vector Implies
This is our reading of the vector, not a statement from Dell. The attacker needs a low-privileged account. The scope is marked as changed (S:C). The impact is high on confidentiality and integrity and none on availability, so the vector points to data being read and changed rather than the system going down.
What SQL Injection Means
MITRE defines CWE-89 as input that reaches a database query without its special characters being neutralized. The attacker can then change what the query does. Dell does not say which input is affected.
What Dell Does Not Say
Dell does not name the input that reaches the database or say what data the database holds. It describes no exploitation and lists no workaround. The flaw was added to the advisory in revision 3.0 of 19 October 2026.
How It Differs From the Other Two
The two other Management Center flaws are CVE-2026-90717, a spoofing bypass of authentication, and CVE-2026-103799, a missing authorization flaw. This one is about input that reaches the database.
Who is affected
Dell lists Data Domain Management Center with DD OS as affected. Dell lists DD OS 7.7.1.0 through 8.8.0.0 on the Feature Release line, 7.13.1.0 through 7.13.1.80 on LTS2024, 8.3.1.0 through 8.3.1.40 on LTS2025 and 8.6.1.0 through 8.6.1.20 on LTS2026.
Dell fixed the flaw in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30. Dell's remediation table has its own rows for Management Center, with the same fixed builds as for the appliances.
Dell groups this flaw with the others of advisory DSA-2026-416, which our post covers by release line.
The same advisory has six more critical flaws with their own pages.
Timeline
- 1 Oct 2026
Dell publishes DSA-2026-416; its revision history shows this date as the initial release.
- 19 Oct 2026
Revision 3.0 of the advisory adds this CVE and five others to its tables of Dell's own code and of affected products.
- 27 Oct 2026
The CISA Known Exploited Vulnerabilities catalog release of this date does not list the flaw.
- 28 Oct 2026
Dell, as CNA, publishes the CVE record at 10:26 UTC with the score of 9.6 and the fixed builds.
What to do
-
Find Management Center
List every Data Domain Management Center instance and the Data Domain systems it manages, with their DD OS builds.
-
Upgrade together
Upgrade Management Center to 8.9.0.0, 7.13.1.90, 8.3.1.50 or 8.6.1.30, or later, and the managed systems too.
-
Review who has accounts
The attacker needs a low-privileged account. Remove accounts that are not needed and check who holds the rest.
-
Review database and application logs
Check Management Center application logs for errors or unusual requests from low-privileged accounts since 1 October 2026. Dell does not say which database sits behind it, so start with the Management Center logs.
-
Limit network reach
Open Management Center only to an admin network. This is hardening, not a Dell workaround.
Questions
Which DD OS builds fix CVE-2026-103792?
DD OS 8.9.0.0 or later on the Feature Release line, 7.13.1.90 or later on LTS2024, 8.3.1.50 or later on LTS2025 and 8.6.1.30 or later on LTS2026.
Is CVE-2026-103792 exploited?
Dell's advisory describes no exploitation, and the CISA KEV catalog release of 27 October 2026 does not list the flaw.
Does CVE-2026-103792 need a login?
Yes, a low-privileged one. Dell describes a low-privileged attacker with remote access, and the vector sets privileges required to low.
What is an SQL injection?
MITRE defines CWE-89 as input that reaches a database query without its special characters being neutralized. Dell does not say which input is affected.
Does it affect the Data Domain appliance itself?
Dell lists it for Data Domain Management Center and describes unauthorized access to managed systems.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 59 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 90 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.