EUVD-2026-66664
GHSA-pvqv-5rgf-98rw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Requires low-privilege authenticated network access; SSRF yields limited confidentiality disclosure only, with no integrity or availability impact and unchanged scope.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
1DescriptionCVE.org
Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
AnalysisAI
Server-Side Request Forgery in Dell Cloud Disaster Recovery versions 20.2 and prior enables a low-privileged authenticated remote attacker to coerce the server into making arbitrary outbound HTTP requests, with limited confidentiality impact per the vendor-confirmed CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). The vulnerability is documented in Dell advisory DSA-2026-353 and affects all releases up to and including version 20.2. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege account on the Dell Cloud Disaster Recovery platform, consistent with PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 4.3 (Medium) reflects a real but bounded risk: network-reachable with low complexity and low privilege, but constrained to a confidentiality-only, unchanged-scope impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult Dell advisory DSA-2026-353 at https://www.dell.com/support/kbdoc/en-us/000500898/dsa-2026-353-security-update-for-cloud-disaster-recovery-vulnerabilities for the specific patched release; patch availability is confirmed per the vendor advisory, but the exact fixed version number was not present in the input data and should be verified directly from the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Cloud Disaster Recovery
View allOS command injection in Dell Cloud Disaster Recovery (versions 20.2 and prior) lets an already high-privileged, remote u
OS command injection in Dell Cloud Disaster Recovery versions 20.2 and prior allows a high-privileged remote attacker to
Dell Cloud Disaster Recovery, version(s) prior to 19.20, contain(s) an Improper Neutralization of Special Elements used
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today