What is the CVSS score of CVE-2026-22267?

CVE-2026-22267 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Powerprotect Data Manager are affected by CVE-2026-22267?

Dell PowerProtect Data Manager installations prior to version 19.22 contain a privilege escalation vulnerability that allows remote attackers with low-level access to gain elevated system…

How to fix or mitigate CVE-2026-22267?

Within 24 hours: Identify all Dell PowerProtect Data Manager instances in your environment and document their versions. Within 7 days: Implement network segmentation to restrict access to PowerProtect Data Manager to authorized administrators only; disable remote access where not operationally required. Within 30 days: Contact Dell for patch availability timeline and expedited release information; develop a patching plan for all affected instances and establish a temporary access control policy limiting privilege escalation opportunities.

Powerprotect Data Manager CVE-2026-22267

HIGH

Incorrect Privilege Assignment (CWE-266)

2026-02-19 security_alert@emc.com

Information Disclosure Dell Powerprotect Data Manager

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

CVE Published

Feb 19, 2026 - 10:16 nvd

HIGH 8.1

DescriptionCVE.org

Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.

AnalysisAI

Dell PowerProtect Data Manager versions prior to 19.22 contain an incorrect privilege assignment flaw that allows remote attackers with low-level credentials to escalate their privileges on affected systems. The vulnerability requires network access and valid authentication but no user interaction, making it exploitable by insiders or attackers who have obtained legitimate credentials. No patch is currently available.

Technical ContextAI

Affects Powerprotect Data Manager. Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.