Dell PowerProtect Data Domain Management Center: Missing authorization
Summary
Dell PowerProtect Data Domain Management Center contains a missing authorization flaw (CWE-862) in several release lines. An attacker with a low-privileged account and network access to the management interface can perform unauthorized operations on managed systems, with scope change and high impact on integrity and availability. No user interaction is required. The CVSS 3.1 score of 9.6 comes from the CNA; NVD analysis is still pending.
Affected
- Feature Release 7.7.1.0 through 8.8
- LTS2024: 7.13.1.0 through 7.13.1.80
- LTS2025: 8.3.1.0 through 8.3.1.40
- LTS2026: 8.6.1.0 through 8.6.1.20
Fixed in
- According to the CVE record, the affected ranges end before 8.9.0.0, 7.13.1.90, 8.3.1.50 and 8.6.1.30 (per release line)
- Confirm the exact fixed build for your release line in Dell advisory DSA-2026-416 before rollout.
Workaround
Unknown. No vendor-published workaround was found; upgrading is the documented remedy.
Exploitation
- No exploitation reported by Dell.
- Not listed in CISA KEV according to secondary coverage; verify directly in the KEV catalog.
- No public proof-of-concept indexed as of 28 October 2026 (third-party indexes may lag).
Our recommendation
- Identify all Data Domain Management Center instances and their versions.
- Confirm that none of them are reachable from the internet or untrusted user networks; restrict access to the management interface.
- Review all low-privileged and shared accounts and remove unneeded ones.
- Patch to the fixed build for your release line after confirming it in the Dell advisory.
- Monitor for public exploit code or KEV listing, as the status can change quickly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-416 Security Update www.dell.com
- Brandefense: Dell Data Domain critical vulnerabilities (DSA-2026-416) brandefense.io
- OffSeq Radar: CVE-2026-103799 radar.offseq.com
- Strix: CVE-2026-103799 www.strix.ai
- SecurityOnline: Dell PowerProtect Data Domain vulnerabilities securityonline.info
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:56.
Original description (NVD)
Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized system operation on managed systems.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.