EUVD-2026-111995
GHSA-qqq8-g3vm-f4r9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege DDMC access
-
DeliverySend request with crafted SQL payload
-
ExploitInjection executes in backend database
-
ExecutionRead/alter console and managed-system data
-
ImpactGain unauthorized access to managed Data Domain systems
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the PowerProtect Data Domain Management Center and a low-privileged authenticated session (CVSS PR:L) - the attacker must already hold or obtain valid low-level credentials to the console; it is not a fully unauthenticated remote flaw. Affected deployments are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. The primary limiting factor is the required authentication; the primary risk amplifier is the scope change, since successful injection reaches the managed Data Domain systems beyond the console itself. The specific feature, endpoint, or configuration that exposes the injectable query is not stated in the available sources. |
| Impact | This is a genuine high-priority issue, not an inflated-CVSS artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, 9.6) describes a remotely reachable, low-complexity SQL injection requiring only low-level authentication (PR:L), with a scope change (S:C) reflecting that exploitation pivots from the DDMC console into the separate managed backup systems - consistent with the description's 'Unauthorized access to managed systems.' The vuln.today priority is act_now and a vendor patch is available (Dell DSA-2026-416), which together argue for prompt remediation. However, the signal set is incomplete: this CVE is NOT listed in CISA KEV, no EPSS exploitation probability was supplied, and no SSVC automatable/technical-impact decomposition was provided, so the act_now label is the only explicit urgency signal and cannot be cross-validated against KEV or EPSS. The authentication requirement (PR:L) is a real limiting factor - an attacker needs some valid low-privilege foothold - which tempers the raw score somewhat but does not eliminate concern given the scope change into high-value backup infrastructure. Net: treat as a priority to patch, while noting that active-exploitation and probability data are absent rather than negative. |
| Exploit ScenarioDerived | A low-privileged but authenticated user (or an attacker who has obtained low-privilege credentials) sends a crafted request to Dell PowerProtect Data Domain Management Center that injects SQL into a backend query. Because the flaw carries a scope change, successful injection yields unauthorized access into the separate Data Domain systems the console manages, exposing and potentially altering backup data. No public exploit identified at time of analysis, and the specific injectable parameter or endpoint is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
SQL injection in Dell PowerProtect Data Domain Management Center allows a remote attacker holding a low-privileged authenticated session to execute arbitrary SQL within the console and, because the assessed scope is changed (S:C), cross the console boundary to gain unauthorized access to the managed Data Domain systems. Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; the flaw is rated 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) and is tracked with an act_now priority. No public exploit code was identified at time of analysis and there is no CISA KEV entry, but vendor fixes are available and the required credentials are the only barrier, so consoles reachable from untrusted networks should be updated promptly.
RemediationAI
Dell has released fixed builds for every affected branch, and these are the complete fix because the sources document no workaround: upgrade Feature Release deployments to 8.9.0.0 or later, LTS2024 to 7.13.1.90 or later, LTS2025 to 8.3.1.50 or later, and LTS2026 to 8.6.1.30 or later, following the vendor guidance in DSA-2026-416 (https://www.dell.com/support/kbdoc/en-us/000515178/dsa-2026-416-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities). Prioritize consoles that are reachable from untrusted network segments or shared with delegated operators, since the assessed prerequisite is a valid low-privileged session and the impact extends past the console into managed Data Domain systems; note that upgrading the console does not by itself undo any unauthorized configuration changes already made on managed appliances, so those should be reviewed after patching. The referenced advisory is the authoritative source for build-level prerequisites and any interim instructions Dell may add.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-89 improper neutralization of special elements in an SQL command, located in the web-facing management layer of Dell PowerProtect Data Domain Management Center (CPE cpe:2.3:a:dell:powerprotect_data_domain_management_center), the centralized console used to administer fleets of Data Domain protection storage appliances. Because the injected query runs in the management plane rather than in a single appliance, the CVSS scope-change component is the operationally significant one: a successful injection is assessed to reach the managed Data Domain systems themselves rather than being contained by the console's own privilege model, giving high confidentiality and integrity impact with no availability impact. The exact feature, endpoint, request parameter, or configuration that exposes the injectable query, and the precise backend database interaction, are not described in the available sources, so the trigger conditions should not be assumed beyond the assessed prerequisite of network reachability plus a low-privileged authenticated session (PR:L). Some intelligence feeds tag this CVE as an authentication bypass, but the assessed vector requires valid low-privilege credentials and the description frames it as a low-privileged-actor attack, so it should be handled as a post-authentication injection that escalates across systems rather than as a fully unauthenticated remote flaw.
Know when Powerprotect Data Domain Management Center gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Remotely reachable SQLi (AV:N/AC:L) needing a low-privileged account (PR:L), no user interaction; scope change (S:C) as access reaches managed systems, with high confidentiality/integrity and no stated availability impact.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access to managed systems.
Executive ViewAI
Dell PowerProtect Data Domain Management Center is affected by a critical SQL injection vulnerability that allows an authenticated low-privileged attacker to cross from the console into managed backup appliances, compromising data confidentiality and integrity. This puts backup infrastructure at risk, potentially impacting disaster recovery and regulatory compliance across all environments using the affected versions.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Missing authorization in Dell PowerProtect Data Domain Management Center (DDMC) allows an authenticated low-privileged,
Dell PowerProtect Data Domain Management Center can be coerced into granting elevated privileges to a remote attacker wh
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access con
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injectio
OS command injection (CWE-78) in Dell PowerProtect Data Domain Management Center lets a remote attacker who already hold
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injectio
Dell PowerProtect Data Domain Management Center enforces incomplete authorization checks, letting a low-privileged authe
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 on DDMC contain an OS command
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injecti
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a path traversal vuln
An authentication bypass by spoofing (CWE-290) exists in Dell PowerProtect Data Domain Management Center, affecting Feat
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a DOM-based Cross-Sit
Exploit-DB