Vulnerability-Lookup

CVE-2026-22769 (GCVE-0-2026-22769)

Vulnerability from cvelistv5 – Published: 2026-02-17 19:19 – Updated: 2026-02-18 17:20

Summary

Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.

Severity ?

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-798 - Use of Hard-coded Credentials

Assigner

dell

References

URL

Tags

https://www.dell.com/support/kbdoc/en-us/00042677…

vendor-advisory

Impacted products

Vendor

Product

Version

Dell

RecoverPoint for Virtual Machines

Affected: 5.3 SP4 P1 , < 6.0.3.1 HF1 (semver)

Dell

RecoverPoint for Virtual Machines

Affected: 6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, and 6.0 SP3 P1 , < 6.0.3.1 HF1 (semver)

Credits

Dell would like to thank Peter Ukhanov from Google/Mandiant for reporting this issue.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-22769",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-18T16:50:53.923001Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-02-18",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22769"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-18T17:20:24.267Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22769"
          },
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-02-18T00:00:00.000Z",
            "value": "CVE-2026-22769 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "RecoverPoint for Virtual Machines",
          "vendor": "Dell",
          "versions": [
            {
              "lessThan": "6.0.3.1 HF1",
              "status": "affected",
              "version": "5.3 SP4 P1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "RecoverPoint for Virtual Machines",
          "vendor": "Dell",
          "versions": [
            {
              "lessThan": "6.0.3.1 HF1",
              "status": "affected",
              "version": "6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, and 6.0 SP3 P1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dell would like to thank Peter Ukhanov from Google/Mandiant for reporting this issue."
        }
      ],
      "datePublic": "2026-02-17T18:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible."
            }
          ],
          "value": "Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798: Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-17T19:19:34.178Z",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2026-22769",
    "datePublished": "2026-02-17T19:19:34.178Z",
    "dateReserved": "2026-01-09T18:05:08.764Z",
    "dateUpdated": "2026-02-18T17:20:24.267Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2026-22769",
      "cwes": "[\"CWE-798\"]",
      "dateAdded": "2026-02-18",
      "dueDate": "2026-02-21",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079 ; https://www.dell.com/support/kbdoc/en-us/000426742/recoverpoint-for-vms-apply-the-remediation-script-for-dsa ; https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day ; https://nvd.nist.gov/vuln/detail/CVE-2026-22769",
      "product": "RecoverPoint for Virtual Machines (RP4VMs)",
      "requiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.",
      "vendorProject": "Dell",
      "vulnerabilityName": "Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-22769\",\"sourceIdentifier\":\"security_alert@emc.com\",\"published\":\"2026-02-17T20:22:09.800\",\"lastModified\":\"2026-02-18T20:01:15.983\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.\"},{\"lang\":\"es\",\"value\":\"Dell RecoverPoint para M\u00e1quinas Virtuales, en versiones anteriores a 6.0.3.1 HF1, contiene una vulnerabilidad de credenciales almacenadas en el c\u00f3digo. Esto se considera cr\u00edtico ya que un atacante en remoto no autenticado que conozca la credencial almacenada podr\u00eda, potencialmente, explotar esta vulnerabilidad, lo que permitir\u00eda un acceso no autorizado al sistema operativo subyacente y persistencia a nivel de root. Dell recomienda que los clientes actualicen o apliquen uno de los remedios lo antes posible.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security_alert@emc.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"security_alert@emc.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:recoverpoint_for_virtual_machines:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.0\",\"matchCriteriaId\":\"CDBD4124-5704-4491-837E-C9F6C3B46602\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8A90920-381D-4D65-8DDA-A850B1765919\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD0ABCD5-9273-4799-A916-3518ED5EBB46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp1_p1:*:*:*:*:*:*\",\"matchCriteriaId\":\"800D6F27-0B30-4E0A-94F6-B52367D50761\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp1_p2:*:*:*:*:*:*\",\"matchCriteriaId\":\"97E4273C-646D-402A-B560-13B1F3024488\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp2:*:*:*:*:*:*\",\"matchCriteriaId\":\"20C3E4AB-B2BA-40CA-AD59-00F2A56C2107\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp2_p1:*:*:*:*:*:*\",\"matchCriteriaId\":\"12F25A3A-65DF-4D20-8A94-71A4763CDA38\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp3:*:*:*:*:*:*\",\"matchCriteriaId\":\"497DD11A-28C7-4211-BB03-2AB916AEA8A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp3_p1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E357BFB-EF68-4FC7-89A3-233567F41534\"}]}]}],\"references\":[{\"url\":\"https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079\",\"source\":\"security_alert@emc.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22769\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-22769\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-02-18T16:50:53.923001Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2026-02-18\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22769\"}}}], \"references\": [{\"url\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22769\", \"tags\": [\"government-resource\"]}, {\"url\": \"https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day\", \"tags\": [\"third-party-advisory\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-02-17T21:19:23.729Z\"}, \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-02-18T00:00:00.000Z\", \"value\": \"CVE-2026-22769 added to CISA KEV\"}]}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Dell would like to thank Peter Ukhanov from Google/Mandiant for reporting this issue.\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 10, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Dell\", \"product\": \"RecoverPoint for Virtual Machines\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.3 SP4 P1\", \"lessThan\": \"6.0.3.1 HF1\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Dell\", \"product\": \"RecoverPoint for Virtual Machines\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, and 6.0 SP3 P1\", \"lessThan\": \"6.0.3.1 HF1\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-02-17T18:00:00.000Z\", \"references\": [{\"url\": \"https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-798\", \"description\": \"CWE-798: Use of Hard-coded Credentials\"}]}], \"providerMetadata\": {\"orgId\": \"c550e75a-17ff-4988-97f0-544cde3820fe\", \"shortName\": \"dell\", \"dateUpdated\": \"2026-02-17T19:19:34.178Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-22769\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-18T17:20:24.267Z\", \"dateReserved\": \"2026-01-09T18:05:08.764Z\", \"assignerOrgId\": \"c550e75a-17ff-4988-97f0-544cde3820fe\", \"datePublished\": \"2026-02-17T19:19:34.178Z\", \"assignerShortName\": \"dell\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-22769

Vulnerability from fkie_nvd - Published: 2026-02-17 20:22 - Updated: 2026-02-18 20:01

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

References

URL	Tags
security_alert@emc.com	https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079	Patch, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day	Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22769	US Government Resource

Impacted products

Vendor	Product	Version
dell	recoverpoint_for_virtual_machines	*
dell	recoverpoint_for_virtual_machines	6.0
dell	recoverpoint_for_virtual_machines	6.0
dell	recoverpoint_for_virtual_machines	6.0
dell	recoverpoint_for_virtual_machines	6.0
dell	recoverpoint_for_virtual_machines	6.0
dell	recoverpoint_for_virtual_machines	6.0
dell	recoverpoint_for_virtual_machines	6.0
dell	recoverpoint_for_virtual_machines	6.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "CDBD4124-5704-4491-837E-C9F6C3B46602",
              "versionEndExcluding": "6.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:-:*:*:*:*:*:*",
              "matchCriteriaId": "D8A90920-381D-4D65-8DDA-A850B1765919",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "DD0ABCD5-9273-4799-A916-3518ED5EBB46",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp1_p1:*:*:*:*:*:*",
              "matchCriteriaId": "800D6F27-0B30-4E0A-94F6-B52367D50761",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp1_p2:*:*:*:*:*:*",
              "matchCriteriaId": "97E4273C-646D-402A-B560-13B1F3024488",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "20C3E4AB-B2BA-40CA-AD59-00F2A56C2107",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp2_p1:*:*:*:*:*:*",
              "matchCriteriaId": "12F25A3A-65DF-4D20-8A94-71A4763CDA38",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp3:*:*:*:*:*:*",
              "matchCriteriaId": "497DD11A-28C7-4211-BB03-2AB916AEA8A3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:dell:recoverpoint_for_virtual_machines:6.0:sp3_p1:*:*:*:*:*:*",
              "matchCriteriaId": "3E357BFB-EF68-4FC7-89A3-233567F41534",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible."
    },
    {
      "lang": "es",
      "value": "Dell RecoverPoint para M\u00e1quinas Virtuales, en versiones anteriores a 6.0.3.1 HF1, contiene una vulnerabilidad de credenciales almacenadas en el c\u00f3digo. Esto se considera cr\u00edtico ya que un atacante en remoto no autenticado que conozca la credencial almacenada podr\u00eda, potencialmente, explotar esta vulnerabilidad, lo que permitir\u00eda un acceso no autorizado al sistema operativo subyacente y persistencia a nivel de root. Dell recomienda que los clientes actualicen o apliquen uno de los remedios lo antes posible."
    }
  ],
  "id": "CVE-2026-22769",
  "lastModified": "2026-02-18T20:01:15.983",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "security_alert@emc.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-02-17T20:22:09.800",
  "references": [
    {
      "source": "security_alert@emc.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22769"
    }
  ],
  "sourceIdentifier": "security_alert@emc.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "security_alert@emc.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

NCSC-2026-0065

Vulnerability from csaf_ncscnl - Published: 2026-02-18 13:18 - Updated: 2026-02-18 13:18

Summary

Kwetsbaarheid verholpen in Dell RecoverPoint for Virtual Machines

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

Dell heeft een kwetsbaarheid verholpen in Dell RecoverPoint for Virtual Machines (versies voor 6.0.3.1 HF1).

Interpretaties

De kwetsbaarheid bevindt zich in hardcoded inloggegevens die aanwezig zijn in de software. Dit stelt ongeauthenticeerde aanvallers op hetzelfde netwerk in staat om ongeautoriseerde toegang tot het systeem te verkrijgen. Dit kan de integriteit en vertrouwelijkheid van de getroffen omgevingen in gevaar brengen. Daarbij meldt GTIG dat zij misbruik van de desbetreffende kwetsbaarheid hebben waargenomen sinds ten minste medio 2024, dus al vóór de patch. In de bijgevoegde blogpost heeft GTIG Indicators of Compromise (IoC’s) en YARA-regels opgenomen om de gebruikte malware te kunnen identificeren.

Oplossingen

Dell heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

high

CWE-798

Use of Hard-coded Credentials

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Dell heeft een kwetsbaarheid verholpen in Dell RecoverPoint for Virtual Machines (versies voor 6.0.3.1 HF1).",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheid bevindt zich in hardcoded inloggegevens die aanwezig zijn in de software. Dit stelt ongeauthenticeerde aanvallers op hetzelfde netwerk in staat om ongeautoriseerde toegang tot het systeem te verkrijgen. Dit kan de integriteit en vertrouwelijkheid van de getroffen omgevingen in gevaar brengen.\n\nDaarbij meldt GTIG dat zij misbruik van de desbetreffende kwetsbaarheid hebben waargenomen sinds ten minste medio 2024, dus al v\u00f3\u00f3r de patch. In de bijgevoegde blogpost heeft GTIG Indicators of Compromise (IoC\u2019s) en YARA-regels opgenomen om de gebruikte malware te kunnen identificeren.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Dell heeft updates uitgebracht om de kwetsbaarheid te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Use of Hard-coded Credentials",
        "title": "CWE-798"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.cve.org/CVERecord?id=CVE-2026-22769"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079"
      }
    ],
    "title": "Kwetsbaarheid verholpen in Dell RecoverPoint for Virtual Machines",
    "tracking": {
      "current_release_date": "2026-02-18T13:18:23.815384Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0065",
      "initial_release_date": "2026-02-18T13:18:23.815384Z",
      "revision_history": [
        {
          "date": "2026-02-18T13:18:23.815384Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "RecoverPoint for Virtual Machines"
          }
        ],
        "category": "vendor",
        "name": "Dell"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-22769",
      "cwe": {
        "id": "CWE-798",
        "name": "Use of Hard-coded Credentials"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Hard-coded Credentials",
          "title": "CWE-798"
        },
        {
          "category": "description",
          "text": "Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1 contain a critical hardcoded credential vulnerability allowing unauthorized remote access.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-22769 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-22769.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 10.0,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-22769"
    }
  ]
}

GHSA-C56R-FCF4-6RP2

Vulnerability from github – Published: 2026-02-17 21:31 – Updated: 2026-02-18 18:30

Details

Severity ?

10.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-22769"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-17T20:22:09Z",
    "severity": "CRITICAL"
  },
  "details": "Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.",
  "id": "GHSA-c56r-fcf4-6rp2",
  "modified": "2026-02-18T18:30:35Z",
  "published": "2026-02-17T21:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22769"
    },
    {
      "type": "WEB",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22769"
    },
    {
      "type": "WEB",
      "url": "https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-22769 (GCVE-0-2026-22769)

FKIE_CVE-2026-22769

NCSC-2026-0065

GHSA-C56R-FCF4-6RP2

Tags

Sightings

Nomenclature