CVE-2026-22769
Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability
Description
CVE-2026-22769 is a critical hard-coded credential vulnerability in Dell RecoverPoint for Virtual Machines (RP4VMs) affecting versions prior to 6.0 SP2. The vulnerability allows an unauthenticated, remote attacker to leverage embedded credentials to gain full access to the affected system, leading to complete system compromise. With a maximum CVSS v3.1 base score of 10.0 (Critical severity) and a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, this vulnerability represents the highest possible risk rating, indicating trivial exploitation with catastrophic impact across confidentiality, integrity, and availability. The vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 11, 2026. Dell has addressed this issue in RP4VMs version 6.0 SP2 (6.0.2).
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dell | recoverpoint for virtual machines | < 6.0; 6.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079(Patch, Vendor Advisory)
- https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-22769(US Government Resource)
Weakness Type
CWE-798: Use of Hard-coded Credentials
CVE-2026-22769 is classified under CWE-798, which identifies the use of hard-coded credentials embedded directly in software source code, configuration files, or firmware. In the case of Dell RP4VMs, the product contains fixed credentials that cannot be changed by the administrator and are identical across all installations. An attacker who discovers or reverse-engineers these credentials can authenticate to any vulnerable RP4VMs deployment without requiring legitimate credentials. Hard-coded credentials are considered one of the most severe software weaknesses because they cannot be mitigated through configuration changes alone and because the same credentials work against every affected installation globally, enabling mass exploitation.
Impact Analysis
Complete System Compromise is the direct consequence of exploiting CVE-2026-22769. The CVSS score of 10.0 with a changed scope (S:C) and maximum ratings across all three impact dimensions (C:H/I:H/A:H) indicates that an attacker gains unrestricted access to the RP4VMs system and can potentially pivot to affect systems beyond the vulnerable component. Dell explicitly states that exploitation leads to data theft, configuration changes, and service disruption.
Confidentiality Impact is catastrophic. An attacker with full system access can read all data managed by the RecoverPoint appliance, including virtual machine replication data, backup configurations, storage credentials, and potentially the contents of replicated virtual machine disks. In disaster recovery environments, this data often contains complete copies of production workloads, making the confidentiality breach equivalent to compromising the production systems themselves.
Integrity Impact is equally severe. With full access, an attacker can modify replication configurations, alter backup data, tamper with recovery point journals, or inject malicious content into replicated virtual machine images. This could result in corrupted disaster recovery capabilities or the distribution of compromised VM images during recovery operations.
Availability Impact reaches the maximum rating. An attacker can disrupt or disable the replication and disaster recovery services entirely, delete recovery points, or render the RP4VMs appliance inoperable. For organizations relying on RP4VMs as their primary disaster recovery solution, this could eliminate their ability to recover from outages or data loss events.
Operational Risk is amplified by the nature of the vulnerability. Because the credentials are hard-coded and identical across all vulnerable installations, a single discovery of the credentials enables attacks against every unpatched deployment worldwide. The EPSS score of 0.14652 (95.03rd percentile) confirms a high probability of exploitation.
Exploit Maturity
CVE-2026-22769 is confirmed as actively exploited, evidenced by its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 11, 2026. The EPSS score of 0.14652 (95.03rd percentile) indicates that this vulnerability is exploited at a significantly higher rate than most known vulnerabilities.
Exploitation Complexity is trivially low. The CVSS vector reflects network-accessible exploitation (AV:N) with low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N). Once the hard-coded credentials are known, any attacker can remotely authenticate to any vulnerable RP4VMs instance. Hard-coded credential vulnerabilities are among the easiest to exploit because they require only knowledge of the credential values, which can be obtained through reverse engineering, public disclosure, or sharing within attacker communities.
Widespread Applicability makes this vulnerability particularly dangerous. Unlike vulnerabilities that require specific configurations or environmental conditions, hard-coded credentials affect every installation of the vulnerable software version. Dell's advisory at DSA-2026-069 confirms the scope. CISA's ransomware association is listed as "Unknown," but the level of access granted makes ransomware deployment a plausible secondary attack.
Remediation
Upgrade to RP4VMs 6.0 SP2 Immediately. Dell has released version 6.0 SP2 (6.0.2) to address CVE-2026-22769. This is the only complete remediation because hard-coded credentials cannot be changed through configuration. All deployments running versions prior to 6.0 SP2 must be upgraded as the highest priority. Consult Dell's security advisory DSA-2026-069 for detailed upgrade instructions.
Restrict Network Access to the RP4VMs management interface as a temporary mitigation while planning the upgrade. Place the RP4VMs appliance behind a firewall that limits inbound access to only authorized management workstations and necessary replication partners. Block all internet-facing access to the RP4VMs management ports.
Audit for Compromise Indicators before and after patching. Review authentication logs on the RP4VMs appliance for unexpected login activity, check for unauthorized configuration changes to replication jobs, and verify the integrity of recovery point data. Because the hard-coded credentials grant full access, any unauthorized use could have resulted in subtle data manipulation.
Rotate Dependent Credentials after upgrading. If the RP4VMs appliance has stored credentials for storage arrays, vCenter servers, or other infrastructure components, assume those credentials may have been compromised and rotate them. Similarly, review any network segments or systems accessible from the RP4VMs appliance for signs of lateral movement.
Implement Network Monitoring to detect future exploitation attempts. Configure alerts for connection attempts to RP4VMs management ports from unauthorized source addresses, and monitor for anomalous data transfer patterns that may indicate exfiltration of replicated VM data.
Technical Details
CVE-2026-22769 affects Dell RecoverPoint for Virtual Machines (RP4VMs), a disaster recovery and data replication solution that protects VMware virtual machines through continuous data replication to secondary sites. The vulnerability exists in all versions prior to 6.0 SP2 and stems from credentials that are embedded directly in the product's code or configuration and cannot be modified by the end user.
Hard-coded Credential Characteristics: The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H indicates that the credentials are accessible over the network without any prior authentication or user interaction, and that successful authentication provides capabilities that extend beyond the vulnerable component itself (changed scope). This suggests the credentials may grant root-level or administrative access to the underlying operating system of the RP4VMs appliance, not merely application-level access.
Attack Surface: The RP4VMs appliance exposes management interfaces over the network for administration, monitoring, and replication configuration. These interfaces accept the hard-coded credentials, allowing an unauthenticated attacker to authenticate as a privileged user. The low attack complexity (AC:L) confirms that no special conditions or race conditions are required for successful exploitation.
Affected Deployments: All Dell RP4VMs installations running versions earlier than 6.0.2 are vulnerable. The product is typically deployed in enterprise data centers and cloud environments where disaster recovery for VMware workloads is required. Each vulnerable installation contains identical hard-coded credentials, meaning discovery of the credential on any single instance exposes all others.
Scope of Access: The changed scope (S:C) and maximum impact ratings across all three CIA dimensions indicate that exploitation grants access not only to the RP4VMs appliance itself but potentially to connected storage systems, vCenter environments, and replicated virtual machine data. The appliance by design has privileged access to storage arrays and hypervisor management layers to perform its replication functions.
Frequently Asked Questions
How severe is CVE-2026-22769?
CVE-2026-22769 carries the maximum possible CVSS score of 10.0 (Critical). It allows an unauthenticated remote attacker to gain full control of the Dell RP4VMs appliance using hard-coded credentials, potentially compromising all replicated VM data and connected infrastructure.
Can I mitigate CVE-2026-22769 without upgrading?
No permanent mitigation exists without upgrading because the credentials are hard-coded and cannot be changed by administrators. You can reduce exposure temporarily by restricting network access to the RP4VMs management interface using firewall rules, but upgrading to version 6.0 SP2 is the only complete fix.
What versions of Dell RP4VMs are affected?
All versions of Dell RecoverPoint for Virtual Machines prior to 6.0 SP2 (version 6.0.2) are affected. Dell has released version 6.0 SP2 to address this vulnerability as documented in advisory DSA-2026-069.
Is CVE-2026-22769 being actively exploited?
Yes. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of March 11, 2026. The EPSS score of 0.14652 (95.03rd percentile) further confirms a high probability of active exploitation.
Could this vulnerability lead to ransomware attacks?
CISA classifies the ransomware association as "Unknown." However, given that exploitation grants full system access including the ability to modify or encrypt replicated VM data, ransomware deployment is a realistic secondary attack scenario that organizations should consider in their risk assessment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.