EUVD-2026-47732
GHSA-p5gf-3w86-63p3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
REST API is network-reachable with low complexity, but the flaw requires an existing high-privilege account (PR:H); improper validation enables total system compromise, so C/I/A all High.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
AnalysisAI
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, remotely authenticated attacker to abuse improper input validation in the REST API to gain further control over the appliance. Exploitation yields total technical impact (full confidentiality, integrity, and availability compromise) but requires existing high privileges, keeping practical risk moderate. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Technical ContextAI
PowerProtect Data Manager is Dell's enterprise data protection and backup orchestration platform, which exposes a REST API for management and automation. The root cause is CWE-20 (Improper Input Validation): the REST API accepts input from an authenticated client without adequately validating it, permitting an operation or state change that escalates the attacker's effective privileges. The affected component per CPE is cpe:2.3:a:dell:powerprotect_data_manager, spanning all versions below 20.2.0.0. Because backup managers hold credentials and control over protected workloads, privilege escalation within this control plane can extend an attacker's reach across the data-protection estate.
RemediationAI
Vendor-released patch: 20.2.0.0 - upgrade Dell PowerProtect Data Manager to version 20.2.0.0 or later as the primary remediation, following Dell advisory DSA-2026-287 (https://www.dell.com/support/kbdoc/en-us/000488847/dsa-2026-287-security-update-dell-powerprotect-data-manager-for-multiple-security-vulnerabilities). Because exploitation requires high privileges, effective compensating controls until patching include restricting and closely auditing accounts that hold administrative/high-privilege roles on the appliance, limiting network reachability of the REST API management interface to trusted administrative networks or a management VLAN, and enforcing strong authentication (MFA) and session monitoring on privileged access. The trade-off of network restriction is that legitimate automation and remote administration paths must be explicitly whitelisted, which may disrupt existing integrations if not planned.
More in Powerprotect Data Manager
View allElevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Ac
Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information in
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgott
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. Rated high severity (CVSS 8
Dell PowerProtect Data Manager versions prior to 19.22 contain an incorrect privilege assignment flaw that allows remote
Stack buffer overflow (CWE-121) in the file-level restore agent of Dell PowerProtect Data Manager versions 20.2.0.0 and
Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Ele
Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation
Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authent
Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged a
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. Rated h
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today