Data Domain Management Center CVE-2026-90717

Exploitation requires the attacker to already hold a low-privileged, authenticated account with remote network access to the Dell PowerProtect Data Domain Management Center (PR:L, AV:N) - it is not fully unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), with no special configuration prerequisite described in the sources. The principal limiting factor is the need for valid low-privilege credentials/access to the Management Center; the principal risk amplifier is the scope change (S:C), since a successful escalation can impact other managed Data Domain systems rather than the management center alone. Affected deployments are Feature Release 7.7.1.0-8.8, LTS2024 7.13.1.0-7.13.1.80, LTS2025 8.3.1.0-8.3.1.40, and LTS2026 8.6.1.0-8.6.1.20; fixes are available in 8.9.0.0 (Feature Release), 7.13.1.90 (LTS2024), 8.3.1.50 (LTS2025), and 8.6.1.30 (LTS2026).

This is a genuine high-priority issue rather than a CVSS-inflated one. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L, 9.1) describes a network-reachable, low-complexity authentication-bypass-by-spoofing (CWE-290) that a low-privileged attacker can leverage for elevation of privilege, with a scope change (S:C) that explicitly extends to other managed Data Domain systems - a trust-boundary escalation consistent with a central management plane. The vuln.today Decision label is act_now, and a vendor patch is already available, which raises urgency. However, signal coverage is incomplete and partly conflicting in weight: there is no CISA KEV listing, no EPSS probability, and no proof-of-concept in the supplied data, so exploitation is not demonstrated - status is no public exploit identified at time of analysis. The act_now label therefore rests on severity, network reachability, low attacker prerequisites and the scope-changing blast radius (one compromised management center potentially affecting multiple backup targets) rather than on observed exploitation. Note the impact asymmetry in the vector: integrity is High while confidentiality and availability are only Low, which fits a privilege-escalation/spoofing flaw more than a data-exfiltration or destructive one. Treat as a priority to patch given the backup-infrastructure role, while recognizing exploitation evidence is currently absent rather than confirmed.

A low-privileged but authenticated user with network access to the PowerProtect Data Domain Management Center abuses the authentication-bypass-by-spoofing flaw to impersonate a higher-privileged identity and elevate privileges within the management console. Because the flaw carries a scope change, the attacker could then act against other managed Data Domain systems governed by that management center. No public exploit is identified at time of analysis, and the low attack complexity (AC:L) means no special timing or environmental conditions are indicated.