CVE-2026-22769

🗓️ 17 Feb 2026 19:19:34Reported by dellType

cve🔗 web.nvd.nist.gov📰️ 17 Media mentions👁 38 Views🌐 WEB

CVE-2026-22769: Dell RecoverPoint for Virtual Machines before 6.0.3.1 HF1 has hardcoded credentials enabling unauthenticated root access.

Reporter	Title	Published	Views	Family All 17
ATTACKERKB	CVE-2026-22769	17 Feb 202619:19	–	attackerkb
Circl	CVE-2026-22769	17 Feb 202619:44	–	circl
CISA KEV Catalog	Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability	18 Feb 202600:00	–	cisa_kev
CISA	CISA Adds Two Known Exploited Vulnerabilities to Catalog	18 Feb 202612:00	–	cisa
CNNVD	Dell RecoverPoint for Virtual Machines 信任管理问题漏洞	17 Feb 202600:00	–	cnnvd
Cvelist	CVE-2026-22769	17 Feb 202619:19	–	cvelist
HackRead	China-Linked Hackers Use Dell RecoverPoint Flaw to Drop GrimBolt Malware	19 Feb 202614:52	–	hackread
NCSC	Vulnerability fixed in Dell RecoverPoint for Virtual Machines	18 Feb 202613:18	–	ncsc
NVD	CVE-2026-22769	17 Feb 202620:22	–	nvd
OSV	CVE-2026-22769	17 Feb 202620:22	–	osv

NVD

Node

dell recoverpoint_for_virtual_machinesRange<6.0

dell recoverpoint_for_virtual_machinesMatch6.0-

dell recoverpoint_for_virtual_machinesMatch6.0sp1

dell recoverpoint_for_virtual_machinesMatch6.0sp1_p1

dell recoverpoint_for_virtual_machinesMatch6.0sp1_p2

dell recoverpoint_for_virtual_machinesMatch6.0sp2

dell recoverpoint_for_virtual_machinesMatch6.0sp2_p1

dell recoverpoint_for_virtual_machinesMatch6.0sp3

dell recoverpoint_for_virtual_machinesMatch6.0sp3_p1

[
  {
    "defaultStatus": "unaffected",
    "product": "RecoverPoint for Virtual Machines",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "6.0.3.1 HF1",
        "status": "affected",
        "version": "5.3 SP4 P1",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "RecoverPoint for Virtual Machines",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "6.0.3.1 HF1",
        "status": "affected",
        "version": "6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, and 6.0 SP3 P1",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
dell	www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
cloud	www.cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day

Parameter	Position	Path	Description	CWE
path	query param	/manager/text/deploy	Tomcat Manager deploy endpoint used to upload and deploy a malicious WAR (upload occurs via request body).	CWE-798
update	query param	/manager/text/deploy	Tomcat Manager deploy endpoint used to upload and deploy a malicious WAR (upload occurs via request body).	CWE-798
cmd	query param	/shell/shell.jsp	Deployed JSP web shell accessible after deployment; can be used to execute commands via the cmd parameter.	CWE-798

20 Feb 2026 02:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.110

EPSS0.22894

SSVC