CVE-2026-90717

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-28 · updated 2026-10-30
Weakness: CWE-290

Description

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability could impact other managed Data Domain systems.

Summary

Dell PowerProtect Data Domain Management Center contains an authentication bypass by spoofing vulnerability (CVE-2026-90717, CVSS 9.1 critical). A low-privileged remote attacker could exploit it to elevate privileges, potentially impacting other managed Data Domain systems. Affected versions include Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. It is not listed in CISA KEV; upgrade to 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later, or 8.6.1.30 or later.

تحتوي Dell PowerProtect Data Domain Management Center على ثغرة تجاوز المصادقة عبر الانتحال (CVE-2026-90717، بدرجة خطورة 9.1 حرجة). يمكن لمهاجم منخفض الصلاحيات لديه وصول عن بُعد استغلالها لرفع الصلاحيات، مما قد يؤثر على أنظمة Data Domain المُدارة الأخرى. تشمل الإصدارات المتأثرة Feature Release من 7.7.1.0 إلى 8.8، وLTS2024 من 7.13.1.0 إلى 7.13.1.80، وLTS2025 من 8.3.1.0 إلى 8.3.1.40، وLTS2026 من 8.6.1.0 إلى 8.6.1.20. الثغرة غير مدرجة في CISA KEV؛ ويُنصح بالترقية إلى 8.9.0.0 أو أحدث، أو 7.13.1.90 أو أحدث، أو 8.3.1.50 أو أحدث، أو 8.6.1.30 أو أحدث.

Affected products

Dell PowerProtect DD: before 8.9.0.0 or later; before 7.13.1.90 or later; before 8.3.1.50 or later; before 8.6.1.30 or later — fixed in 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later, 8.6.1.30 or later

How to fix

Upgrade to a fixed version: Dell PowerProtect DD 8.9.0.0 or later, 7.13.1.90 or later, 8.3.1.50 or later, 8.6.1.30 or later. Check the vendor advisory for mitigations.

References

https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities

Get alerted when CVE-2026-90717 or the next vulnerability affects your stack