Article
Dell Data Domain: Seven Critical Flaws and the Build Each Release Line Needs
Dell's DSA-2026-416 lists seven critical PowerProtect Data Domain flaws, four needing no login. See the fixed DD OS build for each release line.
Read more
Vulnerability
Dell PowerProtect Data Domain Management Center authentication bypass (CVE-2026-90717)
An authentication bypass by spoofing in Dell PowerProtect Data Domain Management Center.
- CVE ID
- CVE-2026-90717
- CVSS
- 9.1 Critical (CVSS 3.1, Dell as CNA)
- Affected product
- PowerProtect Data Domain Management Center (with DD OS)
- Exploited
- Unknown
- Published
- 28 October 2026 (CVE record); Dell advisory DSA-2026-416 dated 1 October 2026
In short
CVE-2026-90717 is an authentication bypass by spoofing in Dell PowerProtect Data Domain Management Center. Dell says a low-privileged remote attacker could elevate privileges, and that other managed Data Domain systems could be impacted. It is rated 9.1 and fixed in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30.
- CVECVE-2026-90717
- ProductDell PowerProtect Data Domain Management Center (with DD OS)
- Fix Steps5actions listedFind Management Center · Upgrade together
What it allows
Dell describes CVE-2026-90717 as an authentication bypass by spoofing in Data Domain Management Center. A low-privileged attacker with remote access could potentially exploit it, leading to elevation of privileges. Dell adds that the flaw could impact other managed Data Domain systems.
Dell, as CNA, scores it 9.1 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L. The CVE record lists CWE-290, Authentication Bypass by Spoofing.
What the Vector Implies
This is our reading of the vector, not a statement from Dell. The attacker needs a low-privileged account, and the scope is marked as changed (S:C). That fits Dell's sentence that other managed systems could be affected.
Two More Critical Management Center Flaws
The same advisory lists two more Management Center flaws at 9.6. CVE-2026-103799 is a missing authorization flaw that leads to unauthorized operation on managed systems. CVE-2026-103792 is an SQL injection that leads to unauthorized access to managed systems. Both need a low-privileged account, and both are fixed in the same builds.
What Dell Does Not Say
Dell does not say what is spoofed, which privileges the attacker gains or how a low-privileged account is obtained. It describes no exploitation and lists no workaround.
Who is affected
Dell lists Data Domain Management Center with DD OS as affected. Dell lists DD OS 7.7.1.0 through 8.8.0.0 on the Feature Release line, 7.13.1.0 through 7.13.1.80 on LTS2024, 8.3.1.0 through 8.3.1.40 on LTS2025 and 8.6.1.0 through 8.6.1.20 on LTS2026.
Dell fixed the flaw in DD OS 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30. Dell's remediation table has its own rows for Management Center, with the same fixed builds as for the appliances.
Dell groups this flaw with the others of advisory DSA-2026-416, which our post covers by release line.
The same advisory has six more critical flaws with their own pages.
Timeline
- 1 Oct 2026
Dell publishes DSA-2026-416; its revision history shows this date as the initial release. Revision 2.0 followed on 7 Oct 2026 as "Minor updates".
- 19 Oct 2026
Revision 3.0 of the advisory adds six other CVEs to it, not this one. Dell's page shows 19 Oct 2026 as its last modification.
- 27 Oct 2026
The CISA Known Exploited Vulnerabilities catalog release of this date does not list the flaw.
- 28 Oct 2026
Dell, as CNA, publishes the CVE record at 08:42 UTC. It carries Dell's score and the fixed builds.
What to do
-
Find Management Center
List every Data Domain Management Center instance and the Data Domain systems it manages, with their DD OS builds.
-
Upgrade together
Upgrade Management Center to 8.9.0.0, 7.13.1.90, 8.3.1.50 or 8.6.1.30, or later, and the managed systems too. Dell says other managed systems could be impacted.
-
Review who has accounts
The attacker needs a low-privileged account. Remove accounts that are not needed and check who holds the rest.
-
Review changes on managed systems
Check configuration changes and administrator actions on managed systems since 1 October 2026 for anything nobody can explain.
-
Limit network reach
Open Management Center only to an admin network. This is hardening, not a Dell workaround.
Questions
Which DD OS builds fix CVE-2026-90717?
DD OS 8.9.0.0 or later on the Feature Release line, 7.13.1.90 or later on LTS2024, 8.3.1.50 or later on LTS2025 and 8.6.1.30 or later on LTS2026.
Is CVE-2026-90717 exploited?
Dell's advisory describes no exploitation, and the CISA KEV catalog release of 27 October 2026 does not list the flaw.
Does CVE-2026-90717 need a login?
Yes, a low-privileged one. Dell describes a low-privileged attacker with remote access, and the vector sets privileges required to low.
Does it affect the Data Domain appliance itself?
Dell lists it for Data Domain Management Center and says it could impact other managed Data Domain systems.
Are there other critical Management Center flaws?
Yes. The same advisory lists CVE-2026-103799 and CVE-2026-103792, both rated 9.6 and both needing a low-privileged account.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 52 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 59 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 90 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.