CVE-2026-103792

Summary

SQL injection in Dell PowerProtect Data Domain Management Center allows low-privileged remote attackers to inject malicious SQL into backend queries, leading to unauthorized access to managed systems.

Exploitability

Exploitation requires low-privileged network access and no user interaction; however, the vulnerability is not publicly exploited as of the description date.

Blast radius

Successful exploitation could enable full read access to the application database and potentially allow lateral movement within managed infrastructure.

Detection

Look for SQL error responses in application logs (e.g., 'SQL syntax error', 'unclosed quote'), unusual query patterns in database audit logs (e.g., long concatenated strings, UNION-based payloads), or repeated failed login attempts followed by anomalous database queries from low-privilege accounts. No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Dell PowerProtect Data Domain Management Center LTS2026 release version 8.6.1.21 or later, or apply the vendor-recommended patch for affected versions (7.7.1.0–8.8, 7.13.1.0–7.13.1.80, 8.3.1.0–8.3.1.40, 8.6.1.0–8.6.1.20).

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.