EUVD-2026-47732
GHSA-p5gf-3w86-63p3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to REST API with high privilege
-
DeliverySend crafted request with invalid input
-
ExploitBypass authorization via improper validation
-
ExecutionEscalate privileges on appliance
-
ImpactFull control of data manager
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the attacker to already possess a high-privilege authenticated account on Dell PowerProtect Data Manager and remote network access to the appliance's REST API (CVSS PR:H, AV:N). The limiting factors are significant: the attacker must be authenticated with high privileges before the flaw can be triggered, so this is a post-authentication escalation rather than an unauthenticated remote compromise. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the high-privilege precondition means realistic risk is confined to insider misuse or scenarios where a privileged credential has already been stolen. Affected only on versions prior to 20.2.0.0. |
| Impact | The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - network-reachable and low-complexity, but gated by PR:H (the attacker must already hold high privileges), which is the dominant limiting factor. EPSS is low at 0.50% (40th percentile), and the SSVC decision framework rates Exploitation as 'none' and Automatable as 'no', while Technical Impact is 'total' - meaning that if exploited the consequences are severe, but real-world exploitation is currently unobserved and not easily scriptable at scale. These signals are consistent rather than conflicting: high impact but constrained by a strong precondition. This is a legitimate patch-worthy issue for defense-in-depth against insider or post-compromise privilege abuse, but not an emergency mass-exploitation scenario. Note the required high privilege level means the practical incremental gain is escalation from an already-trusted account. |
| Exploit ScenarioDerived | An attacker who has already obtained a high-privilege PowerProtect Data Manager account - for example a compromised backup-admin credential or a malicious insider - sends a crafted request to the REST API that carries improperly validated input, causing the platform to perform an action beyond the account's intended authorization and escalating control over the appliance. Given AV:N/AC:L, this can be done remotely with low technical complexity, though the requirement to already hold high privileges (PR:H) sharply narrows who can perform it. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 29, 2026
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, remotely authenticated attacker to abuse improper input validation in the REST API to gain further control over the appliance. Exploitation yields total technical impact (full confidentiality, integrity, and availability compromise) but requires existing high privileges, keeping practical risk moderate. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Earlier versions of this analysis (1)
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation in the REST API, allowing an already high-privileged, remote attacker to escalate into a broader security context with full confidentiality, integrity, and availability impact. The CVSS 3.1 score of 9.1 reflects a scope-changing outcome, though exploitation requires existing high privileges (PR:H). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: 20.2.0.0 - upgrade Dell PowerProtect Data Manager to version 20.2.0.0 or later as the primary remediation, following Dell advisory DSA-2026-287 (https://www.dell.com/support/kbdoc/en-us/000488847/dsa-2026-287-security-update-dell-powerprotect-data-manager-for-multiple-security-vulnerabilities). Because exploitation requires high privileges, effective compensating controls until patching include restricting and closely auditing accounts that hold administrative/high-privilege roles on the appliance, limiting network reachability of the REST API management interface to trusted administrative networks or a management VLAN, and enforcing strong authentication (MFA) and session monitoring on privileged access. The trade-off of network restriction is that legitimate automation and remote administration paths must be explicitly whitelisted, which may disrupt existing integrations if not planned.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PowerProtect Data Manager is Dell's enterprise data protection and backup orchestration platform, which exposes a REST API for management and automation. The root cause is CWE-20 (Improper Input Validation): the REST API accepts input from an authenticated client without adequately validating it, permitting an operation or state change that escalates the attacker's effective privileges. The affected component per CPE is cpe:2.3:a:dell:powerprotect_data_manager, spanning all versions below 20.2.0.0. Because backup managers hold credentials and control over protected workloads, privilege escalation within this control plane can extend an attacker's reach across the data-protection estate.
Know when Powerprotect Data Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
REST API is network-reachable with low complexity, but the flaw requires an existing high-privilege account (PR:H); improper validation enables total system compromise, so C/I/A all High.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
Executive ViewAI
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an elevation-of-privilege flaw allowing a compromised administrator to gain complete control over the backup infrastructure. Since this system is essential for disaster recovery and incident response, its complete compromise could prevent the organization from recovering from cyberattacks or outages. Patching to version 20.2.0.0 or later is required immediately to prevent this critical gap in business continuity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Powerprotect Data Manager
View allElevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Ac
Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information in
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgott
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. Rated high severity (CVSS 8
Dell PowerProtect Data Manager versions prior to 19.22 contain an incorrect privilege assignment flaw that allows remote
Stack buffer overflow (CWE-121) in the file-level restore agent of Dell PowerProtect Data Manager versions 20.2.0.0 and
Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Ele
Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation
Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authent
Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged a
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. Rated h
Exploit-DB