CVE-2026-103792

Dell PowerProtect Data Domain Management Center

CRITICAL 9.6

At a glance

Source: CVE.org
State: PUBLISHED
Published: 2026-10-28 10:26 UTC
Updated: 2026-10-29 10:45 UTC
Assigner: dell

Description

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access to managed systems.

Weaknesses (CWE)

CWE-89 — SQL Injection

References

https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N	dell

European references

ENISA EUVD · EUVD-2026-111995
GCVE · GCVE-0-2026-103792

Affected products

Product	Versions
Dell · PowerProtect Data Domain Management Center	affected 0 < 8.9.0.0 or later ; affected 0 < 7.13.1.90 or later ; affected 0 < 8.3.1.50 or later ; affected 0 < 8.6.1.30 or later

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
ENISA EUVD	ENISA — reproduction authorised, source acknowledged