Hardcoded Credential Vulnerability in Dell RecoverPoint for Virtual Machines
CVE-2026-22769

10CRITICAL

Key Information:

Vendor

Dell
Status
Recoverpoint For Virtual Machines
Vendor
CVE Published:
17 February 2026

Badges

📈 Score: 1,590👾 Exploit Exists🟣 EPSS 28%🦅 CISA Reported

What is CVE-2026-22769?

CVE-2026-22769 is a critical vulnerability found in Dell RecoverPoint for Virtual Machines, specifically in versions prior to 6.0.3.1 HF1. This software is designed to provide continuous data protection and recovery services for virtual machine environments, allowing organizations to efficiently manage data backup and disaster recovery. The vulnerability arises from hardcoded credentials within the system, which enables unauthenticated remote attackers having knowledge of these credentials to gain unauthorized access to the underlying operating system. This access can result in root-level persistence, effectively compromising system integrity and security. Organizations relying on this software are at risk of significant operational disruption and data breaches due to this vulnerability.

Potential impact of CVE-2026-22769

  1. Unauthorized System Access: Attackers can exploit the hardcoded credentials to gain unauthorized access to the system, potentially leading to the manipulation, theft, or destruction of sensitive data.

  2. Root-Level Persistence: The ability to achieve root access enables attackers to maintain persistence within the system, making it difficult for organizations to detect and eliminate the threat, which may lead to continued exploitation over time.

  3. Operational Disruption: The exploitation of this vulnerability can severely disrupt daily operations, as attackers could disable recovery features, compromise data integrity, or launch further attacks within the IT environment.

CISA has reported CVE-2026-22769

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-22769 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

RecoverPoint for Virtual Machines 5.3 SP4 P1 < 6.0.3.1 HF1

RecoverPoint for Virtual Machines 6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, and 6.0 SP3 P1 < 6.0.3.1 HF1

References

https://www.dell.com/support/kbdoc/en-us/000426773/dsa-20...
vendor-advisory

EPSS Score

28% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dell would like to thank Peter Ukhanov from Google/Mandiant for reporting this issue.
JSON
.