CVE-2026-90717

Summary

A low-privileged attacker with remote access can bypass authentication via spoofing in Dell PowerProtect Data Domain Management Center versions 7.7.1.0–8.8 (Feature Release), 7.13.1.0–7.13.1.80 (LTS2024), 8.3.1.0–8.3.1.40 (LTS2025), and 8.6.1.0–8.6.1.20 (LTS2026), leading to privilege escalation and potential compromise of other managed Data Domain systems.

Exploitability

Exploitation requires low-privileged remote access and knowledge of the authentication spoofing technique; no public exploit is available, suggesting moderate difficulty.

Blast radius

Successful exploitation could allow an attacker to escalate privileges and gain unauthorized control over other managed Data Domain systems within the environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Dell PowerProtect Data Domain Management Center Feature Release 8.9 or later, LTS2024 7.13.1.81 or later, LTS2025 8.3.1.41 or later, or LTS2026 8.6.1.21 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.