{"id":"CVE-2026-90717","published":"2026-10-28T09:17:08.297","lastModified":"2026-10-28T09:17:08.297","description":"Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability could impact other managed Data Domain systems.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L","cwes":["CWE-290"],"vendors":[],"products":[],"references":[{"url":"https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A low-privileged attacker with remote access can bypass authentication via spoofing in Dell PowerProtect Data Domain Management Center versions 7.7.1.0–8.8 (Feature Release), 7.13.1.0–7.13.1.80 (LTS2024), 8.3.1.0–8.3.1.40 (LTS2025), and 8.6.1.0–8.6.1.20 (LTS2026), leading to privilege escalation and potential compromise of other managed Data Domain systems.","exploitability":"Exploitation requires low-privileged remote access and knowledge of the authentication spoofing technique; no public exploit is available, suggesting moderate difficulty.","blast_radius":"Successful exploitation could allow an attacker to escalate privileges and gain unauthorized control over other managed Data Domain systems within the environment.","remediation":"Upgrade to Dell PowerProtect Data Domain Management Center Feature Release 8.9 or later, LTS2024 7.13.1.81 or later, LTS2025 8.3.1.41 or later, or LTS2026 8.6.1.21 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","privilege-escalation","spoofing","ddm","dell"],"model":"garnet-coder","analyzedAt":"2026-10-28T10:04:29.215Z"}}