CVE-2026-90724 in PowerProtect Data Domain Management Center
Summary
by MITRE • 10/28/2026
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The Dell PowerProtect Data Domain Management Center software, encompassing Feature Release versions 7.7.1.0 through 8.8 and specific Long Term Support releases including LTS2024 version 7.13.1.0 through 7.13.1.80, LTS2025 version 8.3.1.0 through 8.3.1.40, and LTS2026 version 8.6.1.0 through 8.6.1.20, is susceptible to a critical SQL injection vulnerability. This flaw falls under the category of Improper Neutralization of Special Elements used in an SQL Command, widely recognized as CWE-89 in industry standard classification systems. The presence of this vulnerability indicates that the application fails to adequately sanitize or validate user-supplied input before incorporating it into dynamically constructed database queries. Consequently, if malicious actors can inject specially crafted SQL statements through these inputs, they may manipulate the underlying database structure and content beyond intended boundaries.
Exploitation of this flaw requires a high privileged attacker with remote access capabilities, which significantly narrows the attack surface compared to unauthenticated exploits but still poses severe risks within compromised network environments or insider threat scenarios. Once exploited, the primary impact is information disclosure, allowing attackers to extract sensitive data stored in the management center's database. This could include configuration details, user credentials, backup job schedules, and potentially other proprietary organizational data managed by the PowerProtect system. The ability to read arbitrary data from the backend SQL server undermines the confidentiality guarantees provided by the security architecture of the Data Domain Management Center.
From a tactical perspective, this vulnerability aligns with ATT&CK techniques related to Database Credential Dumping or Query Parameter Manipulation, where adversaries leverage weak input validation to bypass application-level controls and interact directly with database engines. The remote nature of the access requirement means that if an attacker has obtained high-privilege credentials through phishing, credential stuffing, or other initial access vectors, they can proceed to exploit this SQL injection flaw without needing physical proximity or local execution privileges on the target host. This makes it a significant concern for organizations relying on centralized management interfaces for their backup infrastructure security posture.
Mitigation strategies should prioritize immediate patching by upgrading Dell PowerProtect Data Domain Management Center to versions that include fixes for CVE-2024-related SQL injection issues, as specified in official vendor advisories. Until patches are applied, administrators should enforce strict network segmentation to limit remote access to the management interface exclusively to trusted administrative subnets and implement robust Web Application Firewall rules designed to detect and block common SQL injection patterns such as union-based or blind boolean-based payloads. Additionally, enforcing multi-factor authentication for all high-privilege accounts reduces the likelihood of credential compromise leading to exploitation. Regular security audits focusing on input validation practices in custom integrations with the management center are also recommended to prevent similar flaws from being introduced through third-party extensions or APIs.