CVE-2026-103792

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-28 · updated 2026-10-29
Weakness: CWE-89

Description

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access to managed systems.

Summary

Dell PowerProtect Data Domain Management Center contains an SQL injection vulnerability (Improper Neutralization of Special Elements used in an SQL Command) rated CVSS 9.6 critical. A low-privileged attacker with remote access could exploit it to gain unauthorized access to managed systems. Affected versions include Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The flaw is not listed in CISA KEV; no active exploitation is reported. Apply the fixed releases: 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later, or 8.6.1.30 or later.

تحتوي Dell PowerProtect Data Domain Management Center على ثغرة حقن SQL (عدم تحييد العناصر الخاصة المستخدمة في أمر SQL) بتقييم CVSS 9.6 حرجة. يمكن لمهاجم منخفض الصلاحيات لديه وصول عن بُعد استغلالها للوصول غير المصرح به إلى الأنظمة المُدارة. تشمل الإصدارات المتأثرة Feature Release 7.7.1.0 حتى 8.8، وLTS2024 7.13.1.0 حتى 7.13.1.80، وLTS2025 8.3.1.0 حتى 8.3.1.40، وLTS2026 8.6.1.0 حتى 8.6.1.20. الثغرة غير مدرجة في CISA KEV ولا توجد تقارير عن استغلال نشط. طبّق الإصدارات المُصلحة: 8.9.0.0 أو أحدث، أو 7.13.1.90 أو أحدث، أو 8.3.1.50 أو أحدث، أو 8.6.1.30 أو أحدث.

Affected products

Dell PowerProtect DD: before 8.9.0.0 or later; before 7.13.1.90 or later; before 8.3.1.50 or later; before 8.6.1.30 or later — fixed in 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later, 8.6.1.30 or later

How to fix

Upgrade to a fixed version: Dell PowerProtect DD 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later, 8.6.1.30 or later. Check the vendor advisory for mitigations.

References

https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities

Get alerted when CVE-2026-103792 or the next vulnerability affects your stack