PowerProtect Cyber Recovery CVE-2026-49809

Exploitation requires a valid low-privileged user account on the Dell PowerProtect Cyber Recovery instance (PR:L per CVSS vector), network access to the management interface (AV:N), and the target running version 20.2 or earlier. No special non-default configuration is required - the vulnerability appears to exist in standard functionality. Exploitation is limited to authenticated users only; unauthenticated remote access is not indicated by the CVSS vector (PR:L, not PR:N). The impact is bounded to information disclosure (C:H, I:N, A:N), meaning an attacker cannot modify data or disrupt service through this vector alone.

The CVSS 6.5 score reflects a moderate-to-elevated concern: network reachability (AV:N) and low attack complexity (AC:L) lower the exploitation bar significantly, while the low privilege requirement (PR:L) means any authenticated user - including service accounts or lower-tier operators - can trigger the flaw. The confidentiality impact is rated High (C:H), suggesting full or substantial database read access is achievable, which in a Cyber Recovery context could expose backup metadata, recovery plans, credentials, or protected asset inventories. Integrity and availability are not impacted per the CVSS vector, limiting the scenario to data exfiltration rather than data destruction. No EPSS data was provided; without KEV status or a known public exploit, widespread exploitation is not currently confirmed. However, the low barrier to exploitation (no special configuration, no user interaction, minimal privilege) elevates real-world priority above what the moderate score alone might suggest for any internet-exposed or network-accessible deployment of this product.

An attacker with a standard low-privileged account on a Dell PowerProtect Cyber Recovery instance - such as a backup operator or read-only user - sends a crafted HTTP request to a vulnerable management API endpoint, injecting malicious SQL syntax into a query parameter. The application fails to sanitize the input, and the injected SQL is executed against the backend database, returning sensitive records such as backup configuration data, credentials, or protected asset metadata. No public proof-of-concept exploit code has been identified at time of analysis, but the low attack complexity suggests exploitation could be achieved with basic SQL injection tooling.