CVE-2026-22769

The product contains hardcoded credentials (CWE-798) that are identical across all installations. An attacker with knowledge of these credentials can connect to the device over the network without prior authentication and log in to the operating system. No user interaction or special privileges are required — only network access to the device is necessary.

An attacker gains unauthorized access to the operating system at the root level, enabling complete device takeover, data theft, modification of virtual environment configurations, and establishment of persistent presence (persistence) in the victim's infrastructure.

Dell RecoverPoint for Virtual Machines must be immediately updated to version 6.0.3.1 HF1 or later in accordance with vendor recommendations described in bulletin DSA-2026-079 (https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079). Dell recommends applying the update or one of the available workarounds as soon as possible.

Dell RecoverPoint for Virtual Machines in versions prior to 6.0.3.1 HF1

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.