Vulnerability record · CVE-2026-22769 · published 17 February 2026
CVE-2026-22769: Dell RecoverPoint for Virtual Machines hardcoded credential flaw
Dell · Recoverpoint For Virtual Machines
Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1 contain a hardcoded credential vulnerability (CWE-798). An unauthenticated remote attacker who knows the credential can gain access to the underlying operating system, which Dell rates as critical.
Description
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 10.0, unauthenticated remote root-level access, active exploitation reported, and CISA KEV listing with a near-term remediation deadline.
What it is
Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1 contain a hardcoded credential vulnerability (CWE-798). An unauthenticated remote attacker who knows the credential can gain access to the underlying operating system, which Dell rates as critical.
Impact
Successful exploitation gives the attacker unauthorized access to the underlying operating system and the ability to establish root-level persistence.
Attack surface
The flaw is reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. Any internet- or network-exposed RecoverPoint for Virtual Machines instance running an affected version is in scope.
Exploitation
The vulnerability is listed in CISA KEV (added 2026-02-18, due 2026-02-21), and a Google Cloud threat intelligence reference describes exploitation of a Dell RecoverPoint zero-day by UNC6201. EPSS gives a 30-day exploitation probability of 0.13345 (96.2nd percentile).
What to do
- Upgrade to Dell RecoverPoint for Virtual Machines 6.0.3.1 HF1 or later, or apply the remediations in Dell advisory DSA-2026-079.
- If patching cannot be completed by the CISA due date, isolate affected instances from untrusted networks and restrict management access.
- Rotate any credentials associated with the affected appliance and review for unauthorized accounts or persistence.
- Follow BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
Detection
- Monitor authentication and login events on RecoverPoint for Virtual Machines appliances for unexpected or anomalous access.
- Hunt for new or modified local accounts, SSH keys, cron jobs, or other persistence mechanisms on the underlying operating system.
- Review network logs for connections to RecoverPoint management interfaces from unfamiliar or external sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-22769 to the Known Exploited Vulnerabilities catalog on 18 February 2026 as "Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability". Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Federal deadline 21 February 2026.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079 | PatchVendor Advisory |
| https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day | Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22769 | US Government Resource |
Track CVE-2026-22769 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-22769), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
