SECURITYCRITICALCVE-2026-90717

CVE-2026-90717: Dell Data Domain Management Center Authentication Bypass by Spoofing (CVSS 9.1)

A spoofing-based authentication bypass in Dell PowerProtect Data Domain Management Center is rated CVSS 9.1. Patch to the fixed DD OS builds in DSA-2026-416.

Dylan H.

Security Team

October 29, 2026
2 min read
CVE-2026-90717: Dell Data Domain Management Center Authentication Bypass by Spoofing (CVSS 9.1)

Critical severity

Rated critical. Prioritise patching — see the remediation guidance below.

Affected Products

  • Dell PowerProtect Data Domain Management Center, Feature Release 7.7.1.0 through 8.8
  • Dell PowerProtect Data Domain Management Center, LTS2024 7.13.1.0 through 7.13.1.80
  • Dell PowerProtect Data Domain Management Center, LTS2025 8.3.1.0 through 8.3.1.40
  • Dell PowerProtect Data Domain Management Center, LTS2026 8.6.1.0 through 8.6.1.20

CVE-2026-90717: Authentication Bypass in Data Domain Management Center

CVE-2026-90717 is an Authentication Bypass by Spoofing vulnerability in the Dell PowerProtect Data Domain Management Center, scored CVSS 9.1. Unlike its three sibling CVEs, which affect the core DD OS, this one targets the centralized management component. Other databases classify the weakness as a privilege management or missing authorization problem.

It was published on October 28, 2026 as part of Dell advisory DSA-2026-416.

Vulnerability Overview

AttributeValue
CVE IDCVE-2026-90717
CVSS Score9.1 (Critical)
WeaknessAuthentication Bypass by Spoofing
ComponentData Domain Management Center
Dell AdvisoryDSA-2026-416
Known ExploitationNone reported at time of writing
WorkaroundNone published; upgrade required

Affected and Fixed Versions

Release TrainAffectedFixed
Feature Release7.7.1.0 through 8.88.9.0.0
LTS20247.13.1.0 through 7.13.1.807.13.1.90
LTS20258.3.1.0 through 8.3.1.408.3.1.50
LTS20268.6.1.0 through 8.6.1.208.6.1.30

Why This Matters

A management console typically holds credentials, policies, and administrative reach across every managed appliance. Bypassing authentication there can expose an entire backup fleet from a single entry point.

Related CVEs in the same advisory: CVE-2026-86397, CVE-2026-86400, and CVE-2026-86384.

Remediation

  1. Upgrade to the fixed build for your release train.
  2. Place Management Center behind a management VLAN or VPN; never expose it to the internet or general user networks.
  3. Review administrative sessions and audit logs for unfamiliar sources or privilege changes.
  4. Rotate credentials stored in or used by Management Center if suspicious activity is found.

Key Takeaways

  1. CVE-2026-90717 is a CVSS 9.1 authentication bypass in Data Domain Management Center.
  2. Same fixed builds as the rest of DSA-2026-416: 8.9.0.0, 7.13.1.90, 8.3.1.50, 8.6.1.30.
  3. Isolate management planes and patch all four CVEs together.

Sources