Dell PowerProtect Data Domain Management Center CVE-2026-90717 (CVSS 9.1): a low-privileged remote user can spoof authentication, gain higher privileges and reach managed Data Domain systems
Dell's CVE record for CVE-2026-90717, published Oct 28 and updated Oct 30, describes an authentication bypass by spoofing in PowerProtect Data Domain Management Center (DDMC). A low-privileged attacker with remote access could elevate privileges, and Dell says this "could impact other managed Data Domain systems." CVSS 3.1: 9.1 (scope changed).
- Affected: feature releases 7.7.1.0 through 8.8; LTS2024 7.13.1.0 to 7.13.1.80; LTS2025 8.3.1.0 to 8.3.1.40; LTS2026 8.6.1.0 to 8.6.1.20.
- Fixed: 8.9.0.0, 7.13.1.90, 8.3.1.50 or 8.6.1.30 (DSA-2026-416).
- No known exploitation; not in CISA KEV.
DDMC manages backup appliances, so a takeover can reach the backups you'd need for ransomware recovery. Patch it, and keep its management interface off user networks.
Sources: CVE-2026-90717 record (CNA: Dell) · Dell DSA-2026-416: Security update for Dell PowerProtect Data Domain multiple vulnerabilities