CVE-2026-90721 in PowerProtect Data Domain
Summary
by MITRE • 10/28/2026
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The identified security flaw resides within Dell PowerProtect Data Domain systems across multiple software release tracks including Feature Releases 7.7.1.0 through 8.8 and various Long Term Support releases spanning from LTS2024 version 7.13.1.0 up to 7.13.1.80, as well as LTS2025 versions 8.3.1.0 through 8.3.1.40 and LTS2026 versions 8.6.1.0 through 8.6.1.20. This vulnerability is classified technically as a Path Traversal issue, which fundamentally involves the improper neutralization of special elements used in an operating system path that are not properly filtered or escaped during processing. In the context of enterprise storage appliances like PowerProtect Data Domain, such flaws typically arise when user-supplied input containing directory traversal sequences, such as dot-dot-slash characters, is processed by internal services without adequate validation against a predefined allowlist of acceptable paths.
The operational impact of this vulnerability is characterized primarily by its requirement for high privileged access and local presence on the target system. An attacker must already possess valid authentication credentials with elevated privileges to interact with the vulnerable components within the Data Domain operating environment. This constraint significantly limits the attack surface compared to remote exploitation vectors, as it necessitates physical or network-level proximity sufficient to establish a session with administrative rights. Once authenticated at this level, an adversary can leverage the path traversal flaw to manipulate file system operations in unintended ways. The primary consequence observed is a Denial of Service condition, where the manipulation of paths leads to application crashes, service interruptions, or resource exhaustion that renders the storage appliance unavailable for legitimate data protection and recovery tasks.
From a classification perspective, this vulnerability aligns with Common Weakness Enumeration identifier CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory. This weakness category encompasses scenarios where software does not properly validate input paths before using them in file system operations, allowing access outside the intended directory structure. Furthermore, within the MITRE ATT&CK framework, this behavior maps to techniques associated with Defense Evasion and potentially Impact categories depending on how the denial of service is executed, such as resource exhaustion or disruption of availability through maliciously crafted inputs that crash critical storage management services. The exploitation does not typically lead directly to arbitrary code execution in this specific instance but rather focuses on disrupting operational continuity by exploiting logic errors in path resolution mechanisms within the appliance software stack.
Mitigation strategies for this vulnerability center heavily on applying vendor-provided patches and updates immediately upon availability, as Dell has released fixes addressing these specific version ranges. Administrators should verify their current firmware versions against the affected list provided in official security advisories and upgrade to patched releases that implement stricter input validation and path canonicalization checks before processing requests. Additionally, since exploitation requires high privileged local access, enforcing strict role-based access control policies is critical. This includes limiting administrative account usage to essential maintenance windows, employing multi-factor authentication for all privileged sessions, and monitoring system logs for unusual patterns of file system access or repeated failed login attempts that might indicate reconnaissance activity preceding an exploit attempt. Regular auditing of user permissions ensures that only authorized personnel can interact with the underlying services susceptible to this path traversal flaw, thereby reducing the risk surface even if a vulnerability were present in unpatched systems.