Data Domain Management Center CVE-2026-110540

Exploitation requires a valid low-privileged authenticated account on the Dell PowerProtect Data Domain Management Center (CVSS PR:L), reachable over the network (AV:N); no user interaction is needed (UI:N). The key limiting factor is this pre-existing authentication requirement - an unauthenticated outsider cannot exploit it directly. The available sources do not describe which specific management feature, endpoint, or operation lacks the authorization check, so the precise triggering action is not described in the available sources. Affected deployments are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20; fixed versions are 8.9.0.0 (Feature Release), 7.13.1.90 (LTS2024), 8.3.1.50 (LTS2025), and 8.6.1.30 (LTS2026). Dell provides a patch, and updating is the remediation stated by the vendor.

This is a moderate-severity authorization flaw (CVSS 7.1) that should be treated as a near-term patching priority rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable issue exploitable with low attacker effort, but it explicitly requires PR:L - the attacker must already hold a low-privileged authenticated account on the Management Center, which materially limits the exploitation population to users who already have some access. Impact is skewed toward integrity (C:N/I:H/A:L): no confidentiality loss, a high integrity impact (unauthorized operations), and only low availability impact, consistent with a missing-authorization (CWE-862) weakness that lets an under-privileged user perform actions reserved for higher roles. No EPSS score, CISA KEV listing, or public PoC was supplied, so there is no evidence of active or probable exploitation; the vuln.today decision label is 'this_week', pointing to prompt-but-not-crisis remediation. The signals are internally consistent - there is no network-vs-local or auth contradiction to flag. The main caveat is that the only source is the Dell-authored advisory; severity and mechanism have not been independently corroborated.

A low-privileged but authenticated user of Dell PowerProtect Data Domain Management Center sends a request to a function that fails to enforce role-based authorization, allowing them to invoke an operation their account should not be permitted to perform. Because the server does not check the caller's privileges, the attacker carries out an unauthorized management action that alters system state. No public exploit code was identified at the time of analysis, and exploitation requires a valid low-privilege account on the target.