Log in Request a demo

Vulnerability

Dell PowerProtect Data Domain Management Center missing authorization (CVE-2026-103799)

A missing authorization flaw in Dell PowerProtect Data Domain Management Center.

CVE ID
CVE-2026-103799
CVSS
9.6 Critical (CVSS 3.1, Dell as CNA)
Affected product
PowerProtect Data Domain Management Center (with DD OS)
Exploited
Unknown
Published
28 October 2026 (CVE record); added to Dell advisory DSA-2026-416 on 19 October 2026

In short

CVE-2026-103799 is a missing authorization flaw in Dell PowerProtect Data Domain Management Center. Dell says a low-privileged remote attacker could perform unauthorized operations on managed systems. It is rated 9.6 and fixed in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30.

Profile MapVulnerability
  1. CVECVE-2026-103799
  2. ProductDell PowerProtect Data Domain Management Center (with DD OS)
  3. Fix Steps5actions listedFind Management Center · Upgrade together

What it allows

Dell describes CVE-2026-103799 as a missing authorization flaw in Data Domain Management Center. A low-privileged attacker with remote access could potentially exploit it, leading to unauthorized system operation on managed systems.

Dell, as CNA, scores it 9.6 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H. The CVE record lists CWE-862, Missing Authorization.

What the Vector Implies

This is our reading of the vector, not a statement from Dell. The attacker needs a low-privileged account. The scope is marked as changed (S:C). The impact is high on integrity and availability and none on confidentiality, so the vector points to changed or disrupted systems rather than stolen data.

What Missing Authorization Means

MITRE defines CWE-862 as software that does not perform an authorization check when an actor tries to use a resource or run an action. An account that is allowed to log in can then do things its role should not allow.

What Dell Does Not Say

Dell does not say which operations lack the check or which managed systems are exposed. It describes no exploitation and lists no workaround. The flaw was added to the advisory in revision 3.0 of 19 October 2026.

How It Differs From the Other Two

The two other Management Center flaws are CVE-2026-90717, a spoofing bypass of authentication, and CVE-2026-103792, an SQL injection. This one is about what a signed-in account may do, not about who signs in.

Who is affected

Dell lists Data Domain Management Center with DD OS as affected. Dell lists DD OS 7.7.1.0 through 8.8.0.0 on the Feature Release line, 7.13.1.0 through 7.13.1.80 on LTS2024, 8.3.1.0 through 8.3.1.40 on LTS2025 and 8.6.1.0 through 8.6.1.20 on LTS2026.

Dell fixed the flaw in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30. Dell's remediation table has its own rows for Management Center, with the same fixed builds as for the appliances.

Dell groups this flaw with the others of advisory DSA-2026-416, which our post covers by release line.

The same advisory has six more critical flaws with their own pages.

Timeline

  1. 1 Oct 2026

    Dell publishes DSA-2026-416; its revision history shows this date as the initial release.

  2. 19 Oct 2026

    Revision 3.0 of the advisory adds this CVE and five others to its tables of Dell's own code and of affected products.

  3. 27 Oct 2026

    The CISA Known Exploited Vulnerabilities catalog release of this date does not list the flaw.

  4. 28 Oct 2026

    Dell, as CNA, publishes the CVE record at 10:18 UTC with the score of 9.6 and the fixed builds.

What to do

  1. Find Management Center

    List every Data Domain Management Center instance and the Data Domain systems it manages, with their DD OS builds.

  2. Upgrade together

    Upgrade Management Center to 8.9.0.0, 7.13.1.90, 8.3.1.50 or 8.6.1.30, or later, and the managed systems too.

  3. Review who has accounts

    The attacker needs a low-privileged account. Remove accounts that are not needed and check who holds the rest.

  4. Review what each role can do

    Compare the roles in Management Center with the tasks people need. Remove operation rights on managed systems from accounts that do not need them, and check recent operations on managed systems for anything nobody can explain.

  5. Limit network reach

    Open Management Center only to an admin network. This is hardening, not a Dell workaround.

Questions

Which DD OS builds fix CVE-2026-103799?

DD OS 8.9.0.0 or later on the Feature Release line, 7.13.1.90 or later on LTS2024, 8.3.1.50 or later on LTS2025 and 8.6.1.30 or later on LTS2026.

Is CVE-2026-103799 exploited?

Dell's advisory describes no exploitation, and the CISA KEV catalog release of 27 October 2026 does not list the flaw.

Does CVE-2026-103799 need a login?

Yes, a low-privileged one. Dell describes a low-privileged attacker with remote access, and the vector sets privileges required to low.

What is a missing authorization flaw?

MITRE defines CWE-862 as software that does not perform an authorization check when an actor tries to use a resource or run an action. Dell does not say which operations are affected.

Does it affect the Data Domain appliance itself?

Dell lists it for Data Domain Management Center and describes unauthorized operation on managed systems.

In our research

  1. Dell Data Domain: Seven Critical Flaws and the Build Each Release Line Needs October 2026

Sources

  1. DSA-2026-416: Security Update for Dell PowerProtect Data Domain Multiple Vulnerabilities Dell
  2. CVE-2026-103799 CVE.org
  3. Known Exploited Vulnerabilities catalog CISA
  4. CWE-862: Missing Authorization MITRE

Last updated 28 October 2026

Browse the threat library

Keep exploring

Knowledge Hub