Recoverpoint For Virtual Machines
CVE-2026-22769
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover hardcoded credential in RecoverPoint for VM
-
ExploitAuthenticate remotely using known credential
-
ExecutionGain root-level system access
-
ImpactEstablish persistent backdoor on underlying OS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1 with default hardcoded credentials intact. No special conditions — remote unauthenticated exploitation against unpatched instances with default credentials. |
| Impact | CVSS 10.0 (Critical). KEV-listed — actively exploited. Hardcoded credentials = trivially exploitable once known. Root-level access. Patch available. Disaster recovery infrastructure compromise threatens data integrity of all protected VMs. |
| Exploit ScenarioDerived | An attacker obtains the hardcoded credentials (published in exploit databases or discovered through firmware analysis) and connects to an exposed Dell RecoverPoint appliance via SSH or management interface. With root access, the attacker can: tamper with VM replication data (injecting backdoors into backup copies), access all replicated virtual machine disk data (containing databases, file servers, etc.), destroy backup data to prevent recovery during ransomware attacks, or use the appliance as a persistent foothold in the data center network. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) that allow unauthenticated remote attackers with knowledge of the credentials to gain root-level access to the underlying operating system. KEV-listed, this vulnerability exposes disaster recovery infrastructure to complete compromise, potentially affecting the integrity of backup and replication data.
Earlier versions of this analysis (1)
Dell RecoverPoint for Virtual Machines contains hardcoded credentials (CWE-798) that provide unauthenticated remote attackers with root-level access to the appliance operating system when the credentials become known.
RemediationAI
Apply Dell hotfix 6.0.3.1 HF1 immediately. Isolate RecoverPoint management interfaces on dedicated management networks. Restrict SSH access to the appliance. Audit for unauthorized access using the hardcoded credentials. Verify integrity of backup and replication data.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The appliance firmware contains embedded credentials (username/password or SSH keys) that cannot be changed by administrators and are identical across all installations of the affected version. Once these credentials are discovered (through reverse engineering, information sharing, or leak), every unpatched RecoverPoint installation worldwide becomes equally vulnerable. As a disaster recovery product, RecoverPoint has access to VM replication data and backup infrastructure.
Know when Recoverpoint For Virtual Machines gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.
Executive ViewAI
Dell RecoverPoint Virtual Machines contain hardcoded root credentials that allow unauthenticated attackers to gain complete control of backup and replication infrastructure. This vulnerability is actively exploited in the wild and poses an immediate risk to data recovery capabilities and potential lateral movement into critical systems.
Apply vendor patch. If patching is delayed: implement strict network segmentation restricting RecoverPoint access to authorized administrators only; deploy network-based monitoring to detect unusual outbound connections from RecoverPoint systems; disable remote management protocols until patched; implement multi-factor authentication for any administrative access; change default credentials immediately as temporary measure.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command inje
Dell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability
Dell RecoverPoint for Virtual Machines 6.0.x contains use of hard-coded credentials vulnerability. Rated critical severi
Dell RecoverPoint for Virtual Machines 6.0.x contains a vulnerability. Rated critical severity (CVSS 9.8), this vulnerab
Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability. Rated critical sev
Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. Rated crit
Dell RecoverPoint for Virtual Machines 6.0.x contains an OS Command injection vulnerability. Rated high severity (CVSS 8
Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditio
EMC RecoverPoint versions prior to 5.0 and EMC RecoverPoint for Virtual Machines versions prior to 5.0 have an SSL Strip
OS command injection in Dell RecoverPoint for Virtual Machines versions 6.0.3 and 6.0.3.1 enables a high-privileged remo
EMC RecoverPoint for Virtual Machines (VMs) 4.2 allows local users to obtain root-shell access by bypassing the Installa
EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0 are affected by m
GitHub PoC
Exploit-DB