PowerProtect DDMC CVE-2026-90724

Exploitation requires an authenticated session with high privileges (administrative-level access) on the Dell PowerProtect Data Domain Management Center - per CVSS PR:H and the description's 'high privileged attacker with remote access'. The attacker then supplies specially crafted input to a feature that passes it into a SQL command without proper neutralization (CWE-89). The available sources do not name the exact endpoint, parameter, or feature that is vulnerable, nor any non-default configuration required, so the precise trigger is not described in the available sources. The principal limiting factor is the prerequisite high-privileged authentication, which substantially narrows the realistic attacker set; impact is further limited to information disclosure (no data modification or service disruption). Affected versions are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20.

This is a low-priority issue despite being a network-exploitable SQL injection. The CVSS 3.1 base score is only 2.7 (Low), driven by three factors in the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N: exploitation requires high privileges already (PR:H), the impact is limited to partial confidentiality (C:L) with no integrity or availability effect (I:N/A:N), and the scope is unchanged (S:U). The vuln.today decision label is 'monitor', the lowest urgency tier, which is consistent with the low CVSS. There is no CISA KEV listing and no public exploit or PoC reference in the input, so this is not confirmed as actively exploited and no exploit code is identified. No EPSS score was supplied, so statistical exploitation probability cannot be compared against the other signals; this is a data gap rather than a low reading. The signals do not conflict: a high-privilege-only, information-disclosure-only SQL injection against a management appliance is a genuine but minor hardening item, not an emergency. The main caveat is that the attacker must already hold a high-privileged account on the Management Center, which both limits real-world risk and means a successful attacker likely already has significant access.

An attacker who has already obtained high-privileged (administrative) access to the Dell PowerProtect Data Domain Management Center web interface submits a crafted input into a vulnerable field or API parameter that is concatenated into a SQL query, causing the backend to return additional database contents (information disclosure). Because the CVSS vector is AV:N/AC:L/PR:H, this is a remote but authenticated and privilege-gated action with low attack complexity. No public exploit code or PoC is identified in the available sources.