What is the CVSS score of CVE-2026-22769?

CVE-2026-22769 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 34.2%.

Which versions of Recoverpoint For Virtual Machines are affected by CVE-2026-22769?

Dell RecoverPoint Virtual Machines contain hardcoded root credentials that allow unauthenticated attackers to gain complete control of backup and replication infrastructure.. A patch is available.

Is CVE-2026-22769 being actively exploited?

Yes, CVE-2026-22769 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active in-the-wild exploitation. Immediate patching is required.

How to fix or mitigate CVE-2026-22769?

Within 24 hours: Identify all Dell RecoverPoint VMs in your environment and isolate them from production networks if possible; verify current version status. Within 7 days: Apply vendor patch 6.0.3.1 HF1 or later to all affected systems; change all hardcoded credentials immediately post-patching. Within 30 days: Conduct forensic analysis of RecoverPoint logs for unauthorized access; perform security assessment of backup/replication infrastructure for lateral movement indicators.

Recoverpoint For Virtual Machines CVE-2026-22769

CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-02-17 security_alert@emc.com

Dell Authentication Bypass Privilege Escalation RCE Recoverpoint For Virtual Machines

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Added to CISA KEV

Feb 20, 2026 - 02:00 cisa

CISA KEV

Patch released

Feb 20, 2026 - 02:00 nvd

Patch available

CVE Published

Feb 17, 2026 - 20:22 nvd

CRITICAL 10.0

DescriptionCVE.org

Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.

AnalysisAI

Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) that allow unauthenticated remote attackers with knowledge of the credentials to gain root-level access to the underlying operating system. KEV-listed, this vulnerability exposes disaster recovery infrastructure to complete compromise, potentially affecting the integrity of backup and replication data.

Technical ContextAI

The appliance firmware contains embedded credentials (username/password or SSH keys) that cannot be changed by administrators and are identical across all installations of the affected version. Once these credentials are discovered (through reverse engineering, information sharing, or leak), every unpatched RecoverPoint installation worldwide becomes equally vulnerable. As a disaster recovery product, RecoverPoint has access to VM replication data and backup infrastructure.

RemediationAI

Apply Dell hotfix 6.0.3.1 HF1 immediately. Isolate RecoverPoint management interfaces on dedicated management networks. Restrict SSH access to the appliance. Audit for unauthorized access using the hardcoded credentials. Verify integrity of backup and replication data.