CVE-2026-90723 in PowerProtect Data Domain Management Center
Summary
by MITRE • 10/28/2026
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Dell PowerProtect Data Domain Management Center software versions ranging from 7.7.1.0 through 8.8, including specific Long Term Support releases such as LTS2024 version 7.13.1.x, LTS2025 version 8.3.1.x, and LTS2026 version 8.6.1.x, are affected by a critical security flaw classified under CWE-89 Improper Neutralization of Special Elements used in an SQL Command. This vulnerability represents a classic injection attack vector where the application fails to properly sanitize or validate user-supplied input before incorporating it into backend database queries. In these specific versions of the management center software, which serves as the central administrative interface for managing Dell PowerProtect Data Domain systems, there exists insufficient validation logic within certain API endpoints or web forms that process administrative commands and configuration requests.
The technical nature of this flaw allows an attacker to inject malicious SQL statements into input fields that are directly concatenated or interpolated into database queries without adequate escaping mechanisms. Because the vulnerability is located in a management interface typically exposed over network protocols, it presents a remote attack surface. The exploitation requires the adversary to possess high-privileged credentials and have active remote access to the system. This prerequisite significantly limits the pool of potential attackers compared to unauthenticated vulnerabilities but does not eliminate the risk for organizations where insider threats or compromised administrative accounts are a concern. Once authenticated as an administrator, an attacker can manipulate input parameters to alter the structure of SQL commands executed by the underlying database engine.
The primary operational impact of this vulnerability is information disclosure. By leveraging SQL injection techniques such as error-based extraction, blind boolean inference, or time-based delays, an attacker can extract sensitive data stored in the management center's database. This may include credentials for connected storage systems, configuration details regarding backup policies and retention schedules, network topology maps, audit logs containing historical administrative actions, and potentially other proprietary organizational data managed through the platform. The exposure of such information compromises the confidentiality integrity of the entire data protection infrastructure, as it provides adversaries with a comprehensive map of the environment's security controls and sensitive assets.
From an industry standard perspective, this vulnerability aligns closely with CWE-89 SQL Injection and is associated with MITRE ATT&CK technique T1059 Command and Scripting Interpreter if used to execute further commands, or more directly T1078 Valid Accounts when the attacker leverages stolen credentials to gain initial access. The lack of proper input validation also reflects weaknesses in secure coding practices related to parameterized queries versus string concatenation for database interactions. Mitigation strategies must prioritize immediate patching by upgrading Dell PowerProtect Data Domain Management Center to a version that includes the vendor's security fix, which should implement strict type checking and use prepared statements or stored procedures to separate code from data.
In addition to applying software updates, organizations should enforce rigorous access control policies for administrative accounts within the management center. This includes implementing multi-factor authentication where supported, restricting network access to the management interface via firewalls to only trusted IP ranges, and monitoring logs for anomalous query patterns that may indicate exploitation attempts. Regular vulnerability assessments and penetration testing focused on web application security can help identify similar injection points in other components of the data protection ecosystem before they are exploited by malicious actors seeking to compromise backup integrity or exfiltrate critical business information.