EUVD-2026-47734
GHSA-7fmf-3wmg-8gc9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated low-privileged remote user (PR:L, AV:N) exploits a low-complexity token flaw yielding full privilege escalation, giving high confidentiality, integrity and availability impact with unchanged scope.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of Incorrect Security Tokens vulnerability in the IAM. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
AnalysisAI
Elevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Access Management (IAM) subsystem generating incorrect security tokens, letting an already-authenticated low-privileged user obtain rights beyond those granted to their account. The flaw is remotely reachable over the network and requires no user interaction, and while the CVSS base score is 8.8 (High), there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the impact is full compromise of confidentiality, integrity and availability of the data-protection platform, it should be prioritized in any environment running affected versions.
Technical ContextAI
PowerProtect Data Manager is Dell's enterprise data-protection/backup orchestration platform, and the weakness lives in its IAM component, which is responsible for issuing and validating the security tokens that authorize user and service actions. The root cause maps to CWE-1270 (Generation of Incorrect Security Tokens), meaning the token issued to an authenticated principal encodes the wrong authorization context - for example wrong role, scope, or privilege claims - so downstream access-control checks trust a token that grants more than the user is entitled to. The single affected package is identified by the CPE cpe:2.3:a:dell:powerprotect_data_manager, and because tokens underpin every authorized operation, a defect in their generation undermines the platform's entire authorization model rather than a single endpoint.
RemediationAI
Vendor-released patch: upgrade Dell PowerProtect Data Manager to version 20.2.0.0 or later, which remediates this IAM token-generation flaw as documented in Dell advisory DSA-2026-287 (https://www.dell.com/support/kbdoc/en-us/000488847/dsa-2026-287-security-update-dell-powerprotect-data-manager-for-multiple-security-vulnerabilities). No vendor workaround is published for this issue, so if immediate patching is not possible the practical compensating controls are to tightly restrict who holds low-privileged accounts on the appliance, place the Data Manager management interface on an isolated management network reachable only from trusted administrative hosts (reducing the AV:N exposure at the cost of remote-admin convenience), and increase monitoring of IAM/authentication logs for unexpected privilege changes or actions inconsistent with a user's assigned role - accepting that this detects rather than prevents exploitation. Rotating credentials and invalidating existing sessions/tokens after upgrade is also advisable since issued tokens may have carried incorrect claims.
More in Powerprotect Data Manager
View allDell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information in
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgott
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. Rated high severity (CVSS 8
Dell PowerProtect Data Manager versions prior to 19.22 contain an incorrect privilege assignment flaw that allows remote
Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Ele
Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, r
Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authent
Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged a
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. Rated h
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Incorrect Default Permissions vulnerab
Same weakness CWE-1270 – Generation of Incorrect Security Tokens
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today