CVE-2026-90726 in PowerProtect Data Domain
Summary
by MITRE • 10/27/2026
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
The identified security flaw resides within Dell PowerProtect Data Domain systems across multiple software release branches including Feature Releases 7.7.1.0 through 8.8 and various Long Term Support releases spanning from LTS2024 version 7.13.1.0 up to 7.13.1.80, as well as LTS2025 versions 8.3.1.0 through 8.3.1.40 and LTS2026 versions 8.6.1.0 through 8.6.1.20. This vulnerability is classified fundamentally as a Path Traversal issue, which corresponds to Common Weakness Enumeration identifier CWE-22. The core technical deficiency involves an insufficient validation of user-supplied input when processing file paths or directory references within the application logic. Specifically, the system fails to properly neutralize special elements such as dot-dot-slash sequences that could allow navigation outside the intended restricted directory structure. This lack of rigorous sanitization creates a mechanism by which an attacker can manipulate internal path resolution processes to access files and directories that are otherwise protected from standard user interaction.
The operational impact of this vulnerability is characterized primarily by its requirement for high privileged local access, which significantly restricts the attack surface compared to remote exploitation scenarios. An adversary must already possess authenticated credentials with elevated privileges on the target system before they can attempt to leverage this flaw. Once such access is established, the attacker can exploit the path traversal mechanism to read sensitive configuration files, application logs, or potentially other restricted data stored within the file system hierarchy of the Data Domain appliance. While the primary documented consequence is a Denial of Service condition, implying that successful exploitation could cause service disruption through resource exhaustion or critical process termination, the underlying capability also poses risks related to information disclosure depending on specific implementation details and subsequent actions taken by the attacker after gaining unauthorized read access.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1083 File and Directory Discovery, as it enables an actor to enumerate and access files outside of normal operational boundaries. The exploitation path typically involves crafting malicious requests or commands that include relative path navigation sequences intended to break out of the sandboxed environment where application processes are expected to operate. By bypassing these containment measures, the attacker gains a deeper level of visibility into the system architecture than permitted by standard role-based access controls. This undermines the integrity and availability guarantees provided by the Data Domain platform, particularly in environments where data protection appliances serve as critical infrastructure for backup and recovery operations.
Mitigation strategies must focus on immediate patching to address the underlying code defects responsible for the inadequate input validation. Administrators should prioritize upgrading affected Dell PowerProtect Data Domain systems to versions that include the vendor's security fixes for this specific path traversal issue. In addition to software updates, organizations should enforce strict least-privilege principles regarding local account access to these appliances. Limiting who can obtain high-level administrative shells reduces the likelihood of an insider threat or compromised credential leading to exploitation. Furthermore, implementing robust network segmentation ensures that even if a lower-privileged system is breached, lateral movement toward critical backup infrastructure remains restricted by firewall rules and zero-trust architecture principles. Regular auditing of access logs for unusual path traversal attempts can also aid in early detection of such activities within the environment.