PowerProtect DDMC CVE-2026-90723

Exploitation requires the attacker to already possess a high-privileged (administrative) account on the Dell PowerProtect Data Domain Management Center and network reachability to its management interface (CVSS PR:H, AV:N). The affected code path is reachable without user interaction (UI:N) and with low attack complexity (AC:L), but the specific feature, parameter, or query that is vulnerable is not described in the available sources. The dominant limiting factor is the PR:H prerequisite: this is not remotely exploitable by an unauthenticated or low-privileged attacker, which confines realistic risk to compromised-admin or malicious-insider situations. Affected versions are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20.

This is a low-priority issue despite being a network-exploitable SQL injection. The CVSS 3.1 base score is only 2.7, driven by PR:H (requires an already high-privileged account), S:U (no scope change), and a limited impact profile of C:L/I:N/A:N - information disclosure only, with no integrity or availability impact. The AV:N/AC:L metrics indicate it is reachable remotely over the network with low attack complexity, but the high-privilege precondition is the dominant limiting factor: an attacker must already hold elevated access to the management center before this flaw adds any value. There is no EPSS score provided, the vulnerability is NOT on CISA KEV, and no public exploit or PoC reference is present in the input, so there is no public exploit identified at time of analysis. The vendor-assigned priority (vuln.today Decision label 'monitor') is consistent with all these signals. No conflicting signals are present: the CVSS vector, the description ('high privileged attacker with remote access ... Information disclosure'), and the low score all agree. The realistic risk is confined to post-compromise privilege-leverage or malicious-insider scenarios, not opportunistic mass exploitation.

An attacker who already holds high-privileged administrative credentials on the Data Domain Management Center sends crafted input through an application function that builds a SQL query, injecting special characters that are not properly neutralized to read database contents they should not otherwise see. The payoff is limited to information disclosure. No public exploit is identified at time of analysis, so any exploitation would require the attacker to develop their own technique.