---
title: Dell PowerProtect Data Domain Management Center CVE-2026-90717 (CVSS 9.1): a low-privileged remote user can spoof authentication, gain higher privileges and reach managed Data Domain systems | ctxsec
url: https://ctxsec.com/items/dell-ddmc-cve-2026-90717-auth-bypass-dsa-2026-416
description: ""
status: "official (Dell CVE record and DSA-2026-416); no known exploitation"
published: 2026-10-30
---

> 

[← Cybersecurity News](/news) · [markdown](/items/dell-ddmc-cve-2026-90717-auth-bypass-dsa-2026-416.md)

official (Dell CVE record and DSA-2026-416); no known exploitation

2026-10-30

### Dell PowerProtect Data Domain Management Center CVE-2026-90717 (CVSS 9.1): a low-privileged remote user can spoof authentication, gain higher privileges and reach managed Data Domain systems

Dell's CVE record for **CVE-2026-90717**, published Oct 28 and updated Oct 30, describes an **authentication bypass by spoofing** in PowerProtect **Data Domain Management Center (DDMC)**. A low-privileged attacker with remote access could elevate privileges, and Dell says this "could impact other managed Data Domain systems." CVSS 3.1: 9.1 (scope changed).

- **Affected:** feature releases 7.7.1.0 through 8.8; LTS2024 7.13.1.0 to 7.13.1.80; LTS2025 8.3.1.0 to 8.3.1.40; LTS2026 8.6.1.0 to 8.6.1.20.
- **Fixed:** 8.9.0.0, 7.13.1.90, 8.3.1.50 or 8.6.1.30 (DSA-2026-416).
- No known exploitation; not in CISA KEV.

DDMC manages backup appliances, so a takeover can reach the backups you'd need for ransomware recovery. Patch it, and keep its management interface off user networks.

Sources: [CVE-2026-90717 record (CNA: Dell)](https://www.cve.org/CVERecord?id=CVE-2026-90717) · [Dell DSA-2026-416: Security update for Dell PowerProtect Data Domain multiple vulnerabilities](https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities)