PowerProtect Data Domain Path Traversal Leading to DoS (CVE-2026-90721)
CVE-2026-90721 Published on October 28, 2026
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
Vulnerability Analysis
CVE-2026-90721 can be exploited with local system access, and requires user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Path Traversal: '../filedir'
The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize "../" sequences that can resolve to a location that is outside of that directory.
Affected Versions
Dell PowerProtect Data Domain:- Before 8.9.0.0 or later is affected.
- Before 7.13.1.90 or later is affected.
- Before 8.3.1.50 or later is affected.
- Before 8.6.1.30 or later is affected.