EUVD-2026-47728
GHSA-97wp-7vj5-mrg2
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Local vector and high privileges confirmed by description; scope change reflects PPDM leaking secrets belonging to managed external systems, not just internal data.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the REST API. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
AnalysisAI
Dell PowerProtect Data Manager's REST API exposes sensitive information to high-privileged local users in all versions prior to 20.2.0.0. An administrator-level attacker with local access can query the REST API and retrieve sensitive data that should be restricted even at the admin tier - with the CVSS Scope:Changed indicator suggesting the exposed information may include credentials or secrets belonging to systems external to the PPDM instance itself. No public exploit code or active exploitation has been identified at time of analysis; Dell has released version 20.2.0.0 to address this and multiple other vulnerabilities per advisory DSA-2026-287.
Technical ContextAI
Dell PowerProtect Data Manager (CPE: cpe:2.3:a:dell:powerprotect_data_manager:*:*:*:*:*:*:*:*) is an enterprise backup, recovery, and data protection platform commonly deployed to manage and protect workloads across physical, virtual, and cloud environments. The vulnerability resides in its REST API layer and is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), meaning the API returns data beyond the intended authorization boundary for the requesting role. Critically, the CVSS vector includes S:C (Scope Changed), which in the context of a data protection platform strongly suggests the leaked information crosses a security boundary - likely exposing backup target credentials, storage system tokens, or protected workload secrets managed by PPDM - rather than merely leaking PPDM-internal metadata. This is consistent with CWE-200 in systems that act as credential brokers.
RemediationAI
Upgrade Dell PowerProtect Data Manager to version 20.2.0.0 or later, the vendor-confirmed fix version per DSA-2026-287 (https://www.dell.com/support/kbdoc/en-us/000488847/dsa-2026-287-security-update-dell-powerprotect-data-manager-for-multiple-security-vulnerabilities). Where immediate patching is not operationally feasible, implement strict least-privilege controls on PPDM administrative accounts - reducing the number of principals with local admin access limits the exploitable population, though this does not eliminate the underlying flaw. Audit REST API access logs for anomalous data retrieval patterns by admin accounts. Rotate any credentials or secrets stored in or managed by PPDM as a precautionary measure if unpatched for an extended period, since the boundary-crossing nature (S:C) implies connected systems may also be at risk if PPDM-held secrets are harvested. Network-level isolation of the PPDM management interface reduces remote attack surface but does not mitigate the local privileged vector described here.
More in Powerprotect Data Manager
View allElevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Ac
Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information in
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgott
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. Rated high severity (CVSS 8
Dell PowerProtect Data Manager versions prior to 19.22 contain an incorrect privilege assignment flaw that allows remote
Stack buffer overflow (CWE-121) in the file-level restore agent of Dell PowerProtect Data Manager versions 20.2.0.0 and
Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Ele
Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, r
Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authent
Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged a
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today