EUVD-2026-47731
GHSA-3wx7-p748-wxww
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
REST API is network-reachable (AV:N) with low complexity, but the description explicitly requires a high-privileged attacker (PR:H); total technical impact per SSVC supports C:H/I:H/A:H.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
AnalysisAI
Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authenticated attacker abuse an improperly validated REST API input to gain further control over the backup and recovery appliance. Per the CVSS vector the attacker starts with high privileges (PR:H), yet the flaw yields total confidentiality, integrity, and availability impact on the affected system. There is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with a low EPSS probability of 0.50%.
Technical ContextAI
PowerProtect Data Manager is Dell's enterprise data protection platform that orchestrates backup, replication, and recovery across VMware, databases, Kubernetes, and cloud workloads, exposing management functions through a REST API. The weakness is classified as CWE-20 (Improper Input Validation): the REST API accepts input that is not adequately sanitized or bounds-checked before use, allowing a caller to influence privileged operations beyond their intended authorization. Because the affected component is the management API of a backup appliance, successful abuse can pivot administrative-tier access into full control of the data-protection control plane. The single affected CPE is cpe:2.3:a:dell:powerprotect_data_manager, confirming a software-level flaw in the product itself rather than a bundled third-party library.
RemediationAI
Vendor-released patch: upgrade Dell PowerProtect Data Manager to version 20.2.0.0 or later, which is confirmed available per Dell advisory DSA-2026-287 (https://www.dell.com/support/kbdoc/en-us/000488847/dsa-2026-287-security-update-dell-powerprotect-data-manager-for-multiple-security-vulnerabilities). Because exploitation requires high existing privileges over the REST API, effective compensating controls until patching center on constraining who holds those privileges: restrict network reachability of the management REST API to a dedicated administrative network segment or jump host to shrink the attack surface, enforce least-privilege on PPDM administrative roles and remove shared or dormant high-privilege accounts, and enable multi-factor authentication and audit logging on admin logins to detect misuse. These controls reduce the pool of principals able to trigger the flaw but do not close the input-validation gap itself, so they are stopgaps rather than a substitute for the upgrade.
More in Powerprotect Data Manager
View allElevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Ac
Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information in
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgott
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. Rated high severity (CVSS 8
Dell PowerProtect Data Manager versions prior to 19.22 contain an incorrect privilege assignment flaw that allows remote
Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Ele
Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, r
Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged a
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. Rated h
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Incorrect Default Permissions vulnerab
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today