CVE-2026-90730 in PowerProtect Data Domain
Summary
by MITRE • 10/27/2026
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The identified security flaw resides within the Dell PowerProtect Data Domain appliance software ecosystem, specifically affecting a broad range of releases including Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, and LTS2026 release versions 8.6.1.0 through 8.6.1.20. This vulnerability is classified as an Improper Access Control issue, which fundamentally indicates that the software fails to properly enforce restrictions on authenticated users or unauthenticated actors regarding access to system resources or functions. In this specific context, the lack of adequate authorization checks allows an attacker who has established remote network connectivity to interact with internal services in ways that were not intended by the application developers. The core technical flaw involves a breakdown in the authentication and authorization mechanisms that should gatekeep critical administrative interfaces or backend processing routines from unauthorized entities.
From a technical perspective, this vulnerability enables an unauthenticated actor to bypass standard security controls via remote network access. Unlike vulnerabilities that require prior credential compromise, this issue allows exploitation by any external entity capable of reaching the affected service endpoints over the network. The attacker can send specially crafted requests or packets that exploit the missing access control logic, triggering unintended behavior within the application stack. This typically involves manipulating state variables, bypassing session validation checks, or invoking privileged functions without valid credentials. The absence of these safeguards means that the system processes inputs from unverified sources as if they were legitimate administrative commands, leading to a disruption in normal operational flow rather than unauthorized data exfiltration or privilege escalation at this stage.
The primary operational impact of exploiting this vulnerability is a Denial of Service condition against the Dell PowerProtect Data Domain appliance. By triggering the improper access control flaw, an attacker can cause the affected service or subsystem to crash, hang, or enter an unrecoverable error state. For enterprise environments relying on these appliances for critical data protection and backup operations, such a disruption results in significant downtime, preventing scheduled backups from completing and potentially halting replication processes to secondary sites. This loss of availability directly impacts business continuity strategies, as the integrity and accessibility of backed-up data become compromised during the outage window. While the current description highlights denial of service, improper access control vulnerabilities often serve as entry points for more severe attacks if left unpatched, potentially allowing further exploitation vectors in subsequent interactions with the system.
To mitigate this risk, organizations must immediately apply the vendor-provided software updates that address these specific version ranges. It is critical to verify the exact build number of the deployed appliances against the affected list provided by Dell Technologies and prioritize patching for systems exposed to untrusted networks or internet-facing interfaces. In addition to applying patches, administrators should review network segmentation strategies to ensure that management interfaces are not unnecessarily accessible from public networks. Implementing strict firewall rules that restrict access to administrative ports only from trusted IP addresses adds a layer of defense-in-depth. Furthermore, enabling comprehensive logging and monitoring for unusual authentication failures or service restarts can help detect attempted exploitation activities in real time, allowing security teams to respond before a successful denial-of-service event occurs.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-284, which describes Improper Access Control, where the software does not properly restrict permissions for privileged functions. It also maps to MITRE ATT&CK techniques related to Initial Access and Impact, specifically how attackers leverage misconfigurations or logic flaws to disrupt service availability. The remediation strategy focuses on patch management as the primary control, supplemented by network access controls to limit the attack surface available to potential adversaries. Regular vulnerability scanning and configuration audits should be conducted to ensure that no legacy versions remain in production environments without appropriate compensating controls such as web application firewalls or intrusion prevention systems configured to block known exploitation patterns associated with this class of flaws.