What is the CVSS score of CVE-2026-28264?

CVE-2026-28264 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-28264?

Yes, a patch is available for CVE-2026-28264. Update the affected software to the latest version immediately.

Powerprotect Agent CVE-2026-28264

EUVD-2026-20449 MEDIUM

Incorrect Permission Assignment for Critical Resource (CWE-732)

2026-04-08 dell

Information Disclosure Dell Powerprotect Agent

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Severity Changed

Jul 24, 2026 - 20:22 NVD

LOW MEDIUM

CVSS changed

Jul 24, 2026 - 20:22 NVD

3.3 (LOW) 5.5 (MEDIUM)

Patch available

Apr 16, 2026 - 05:29 EUVD

20.1.0.0

EUVD ID Assigned

Apr 08, 2026 - 11:46 euvd

EUVD-2026-20449

Analysis Generated

Apr 08, 2026 - 11:46 vuln.today

CVE Published

Apr 08, 2026 - 11:24 nvd

LOW 3.3

DescriptionNVD

Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

AnalysisAI

Dell PowerProtect Agent prior to version 20.1 allows low-privileged local attackers to read sensitive information through incorrect permission assignment on critical resources. The vulnerability requires local access and existing user privileges but can expose confidential data without requiring user interaction or elevated permissions.

Technical ContextAI

This vulnerability stems from CWE-732 (Incorrect Permission Assignment for Critical Resource), a common weakness in privilege management where file system or resource permissions are not correctly restricted. Dell PowerProtect Agent, a data protection and backup software component, fails to properly enforce access controls on one or more critical resources. An authenticated local user on the system where PowerProtect Agent is installed can leverage these overly permissive access controls to read data that should be restricted to higher-privilege accounts or administrative roles.

RemediationAI

Upgrade Dell PowerProtect Agent to version 20.1 or later. This patch is the primary and recommended fix and addresses the permission assignment vulnerability. Users should apply the security update via Dell's support portal or through their normal patch management process. Detailed guidance and download links are available in Dell Security Advisory DSA-2026-158 at https://www.dell.com/support/kbdoc/en-us/000447277/dsa-2026-158-security-update-dell-powerprotect-data-manager-for-multiple-security-vulnerabilities. Until patched, restrict local system access to only trusted administrators and monitor local user privilege escalation attempts.