EUVD-2026-47735
GHSA-8j96-7wgg-9348
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
REST API is network-reachable (AV:N) with no user interaction, but exploitation needs high administrative privileges (PR:H); remote code execution yields full C/I/A impact on the unchanged-scope appliance.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
AnalysisAI
Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation in the product's REST API, allowing a high-privileged, remotely authenticated attacker to escalate into arbitrary code execution on the data-protection appliance. Dell (the reporting vendor) rates it CVSS 7.2 (High) with full confidentiality, integrity, and availability impact but requiring high privileges (PR:H). There is no public exploit identified at time of analysis, the EPSS probability is low (0.61%, 46th percentile), and CISA SSVC marks exploitation status as none.
Technical ContextAI
Dell PowerProtect Data Manager (PPDM) is an enterprise data-protection and backup management platform that orchestrates backups, replication, and recovery across VMware, databases, Kubernetes, and cloud workloads, exposing management functionality through a REST API. The vulnerability is classified as CWE-20 (Improper Input Validation): the REST API accepts input that is not adequately validated before use, and the flaw's high/high/high impact profile combined with a 'Remote execution' outcome indicates the unvalidated input reaches a code or command execution path on the underlying appliance. Because the affected surface is the administrative API rather than an unauthenticated web front end, exploitation is bounded to actors who can already authenticate at a high privilege level. Affected CPE is cpe:2.3:a:dell:powerprotect_data_manager for all versions below 20.2.0.0.
RemediationAI
Upgrade Dell PowerProtect Data Manager to version 20.2.0.0 or later, which contains the vendor-released fix per Dell Security Advisory DSA-2026-287 (https://www.dell.com/support/kbdoc/en-us/000488847/dsa-2026-287-security-update-dell-powerprotect-data-manager-for-multiple-security-vulnerabilities). Because exploitation requires high privileges via the REST API, effective compensating controls until patching are to restrict and monitor administrative access: limit network reachability of the PPDM management/REST API to a dedicated management VLAN or jump-host allowlist so it is not broadly reachable, enforce strong and rotated credentials plus MFA for administrative accounts to reduce the chance an attacker obtains the required high privileges, and audit REST API access logs for anomalous administrative calls. The trade-off of tightening API network exposure is that legitimate automation and integrations that call the REST API must be re-scoped to the permitted management sources, so inventory those integrations before enforcing allowlists.
More in Powerprotect Data Manager
View allElevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Ac
Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information in
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgott
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. Rated high severity (CVSS 8
Dell PowerProtect Data Manager versions prior to 19.22 contain an incorrect privilege assignment flaw that allows remote
Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Ele
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, r
Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authent
Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged a
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. Rated h
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Incorrect Default Permissions vulnerab
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today