CVE-2026-90719 in PowerProtect Data Domain Management Center
Summary
by MITRE • 10/28/2026
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Dell PowerProtect Data Domain Management Center software, encompassing Feature Release versions 7.7.1.0 through 8.8 and specific Long Term Support releases including LTS2024 version 7.13.1.0 through 7.13.1.80, LTS2025 version 8.3.1.0 through 8.3.1.40, and LTS2026 version 8.6.1.0 through 8.6.1.20, is susceptible to a critical SQL injection vulnerability. This flaw falls under the category of Improper Neutralization of Special Elements used in an SQL Command, widely recognized as CWE-89. The presence of this vulnerability indicates that the application fails to adequately sanitize or validate user-supplied input before incorporating it into dynamically constructed database queries. In secure software architecture, all data entering from external sources must be treated as untrusted and processed through strict whitelisting mechanisms or parameterized query interfaces to prevent malicious code injection.
The technical nature of this flaw allows an attacker with high privileged access and remote connectivity to manipulate the underlying SQL logic executed by the database management system. By injecting specially crafted input strings, typically containing SQL syntax such as UNION statements or boolean-based logical operators, the attacker can alter the intended query structure. This manipulation enables the extraction of data that was not originally intended for retrieval, effectively bypassing standard access controls and application-level security filters. The vulnerability relies on the assumption that high-privilege remote users are trusted entities; however, it highlights a failure in defense-in-depth principles where even authenticated administrators should be subject to input validation constraints when interacting with backend database services.
The operational impact of this SQL injection is primarily centered around unauthorized information disclosure. An exploited instance could lead to the exposure of sensitive configuration data, user credentials, backup metadata, or other proprietary information stored within the PowerProtect Data Domain Management Center database. Given that these systems often manage critical enterprise storage infrastructure and backup operations, the leakage of such data can compromise the integrity and confidentiality of an organization's disaster recovery capabilities. Furthermore, depending on the specific database engine configuration and privileges granted to the application account, there may be potential for further exploitation leading to remote code execution or denial of service conditions, although the primary reported impact is information disclosure.
To mitigate this risk, organizations must immediately apply the vendor-provided patches that address the input validation deficiencies in the affected software versions. It is imperative to verify that all instances running within the specified version ranges are updated to a secure release where proper parameterization or escaping mechanisms have been implemented. In addition to patching, administrators should enforce strict network segmentation policies to limit remote access to only necessary management interfaces and utilize multi-factor authentication for administrative accounts. Regular security audits focusing on input handling in web applications and database interaction layers will help identify similar vulnerabilities before they can be exploited by malicious actors seeking to compromise critical data infrastructure.