Vulnerability details

CVE-2026-22769

Actively exploited

Dell RecoverPoint for Virtual Machines

CVSS 3.1

10.0Critical

Official description

Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.

CVSS scores

Score	Version	Source	Vector
10.0Critical	3.1	CVEProject cvelistV5 (CNA) (dell)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Dell	RecoverPoint for Virtual Machines	5.3 SP4 P1 ≤ v < 6.0.3.1 HF1	CVEProject cvelistV5 (CNA)
Dell	RecoverPoint for Virtual Machines	6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, and 6.0 SP3 P1 ≤ v < 6.0.3.1 HF1	CVEProject cvelistV5 (CNA)

References and advisories

https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079 vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22769 government-resource
https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-02-17
Last updated: 2026-02-26
State: Published
Assigner (CNA): dell
Kolun priority: 79 · High

CISA KEV catalog

Date added: 2026-02-18
Due date: 2026-02-21
Used in ransomware: Unknown

Exploit prediction (EPSS)

13.52%

Probability of exploitation in 30 days

96.4%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Active
Technical impact: Total

Weaknesses (CWE)

CWE-798
Use of Hard-coded Credentials