PowerProtect Cyber Recovery CVE-2026-79938

Exploitation requires a remote attacker to hold at least a low-privileged authenticated account on the Dell PowerProtect Cyber Recovery system, as indicated by PR:L in the CVSS vector. No user interaction is required and attack complexity is rated low (AC:L), meaning no race condition, special timing, or non-default configuration is needed beyond the affected version being reachable over the network. The key limiting factor is the requirement for some level of prior authentication - organizations that strictly control account provisioning on Cyber Recovery systems, enforce strong and unique credentials, and restrict management interface network access significantly reduce exploitability even prior to patching. There is no indication the flaw applies to unauthenticated access.

The CVSS 8.8 High score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) positions this as a serious vulnerability - network-accessible, low complexity, requiring only low privileges. Several signals moderate immediate urgency: EPSS at 0.22% (12th percentile) indicates current exploitation is not widespread, and SSVC rates exploitation as 'none' and automatable as 'no,' consistent with no observed threat actor activity. A notable discrepancy exists between the CVSS impact triad (C:H/I:H/A:H, implying full system compromise) and SSVC's 'partial' technical impact rating - security teams should verify actual blast radius against Dell's full advisory before finalizing severity classification. For any organization operating PowerProtect Cyber Recovery as part of ransomware recovery infrastructure, even a mid-sized enterprise IT team should treat this as a priority patching item within the next maintenance window, since compromise of the backup vault directly negates the recovery strategy it underpins. No public POC has been identified and no CISA KEV listing exists at time of analysis.

An attacker holding a low-privileged account - such as a read-only monitoring or reporting credential - connects remotely to the Dell PowerProtect Cyber Recovery management interface and exploits the improper authentication flaw to gain access beyond their authorized scope. Once authenticated at the elevated level, the attacker can access, exfiltrate, modify, or delete vaulted backup data, directly undermining ransomware recovery capabilities for the victim organization. No public POC has been identified, but the low attack complexity (AC:L) suggests the exploit path does not require unusual preconditions beyond obtaining any valid low-privilege credential.