RecoverPoint for VMs CVE-2026-23501

Exploitation requires that the attacker holds high-privileged (administrative) credentials to the Dell RecoverPoint for VMs management interface, confirmed by the CVSS PR:H metric. Remote network access to the management plane is required (AV:N), but no user interaction is needed once access is established (UI:N). The attack complexity is low (AC:L), meaning no race conditions or special timing are required beyond possessing valid high-privileged credentials. Exploitation is limited to versions 6.0.3 and 6.0.3.1 specifically. The primary limiting factor is the administrative credential prerequisite - an unauthenticated or low-privileged remote attacker cannot directly exploit this vulnerability without first obtaining high-privileged access through another vector.

The CVSS base score of 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H reflects a fully network-exploitable flaw with full triad impact, but the PR:H metric is a critical mitigating factor: exploitation requires that the attacker already holds high-privileged (administrative) credentials to the RecoverPoint management plane. This substantially narrows the realistic attack surface compared to an unauthenticated remote code execution. No EPSS score was provided, and the vulnerability does not appear in the CISA KEV catalog, meaning no confirmed active exploitation is on record. No public proof-of-concept has been identified. The practical risk is elevated for environments where RecoverPoint administrative accounts are shared, weakly protected, exposed to broader network segments, or where insider threat is a concern - but the PR:H bar means casual opportunistic exploitation is unlikely. Organizations running 6.0.3 or 6.0.3.1 in production should treat this as a priority patch given the full-impact CVSS outcome once the privilege bar is cleared.

An attacker who has obtained high-privileged administrative credentials to the Dell RecoverPoint management interface - whether through credential theft, phishing a backup administrator, or lateral movement from a compromised admin workstation - sends a crafted request to a vulnerable management endpoint containing OS command injection sequences (e.g., semicolons, backticks, or pipe characters embedded in a parameter value). The backend processes the input by constructing a shell command without sanitization, causing the injected commands to execute with the privileges of the RecoverPoint service process, yielding arbitrary command execution on the appliance.