EUVD-2026-47730
GHSA-468h-f89p-mhw3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Remote management interface (AV:N) with low complexity, but requires pre-existing high privileges (PR:H); no user interaction, scope unchanged, full CIA impact consistent with privilege elevation.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
AnalysisAI
Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged attacker to abuse improper input validation and gain elevated privileges, with full confidentiality, integrity, and availability impact per the CVSS vector. The flaw was reported by Dell, which has published advisory DSA-2026-287 and a fixed release. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently limited by the requirement for pre-existing high privileges.
Technical ContextAI
PowerProtect Data Manager is Dell's enterprise data-protection and backup management platform used to orchestrate backup, replication, and recovery across VMs, databases, filesystems, and Kubernetes. The root cause is classified as CWE-20 (Improper Input Validation), meaning the application accepts attacker-influenced input over its network-facing management interface without adequately validating it, allowing that input to alter execution and grant privileges beyond what the caller should hold. The single affected CPE is cpe:2.3:a:dell:powerprotect_data_manager, with all versions below 20.2.0.0 in scope; the exact validated field or API endpoint is not disclosed in the advisory data provided.
RemediationAI
Vendor-released patch: upgrade Dell PowerProtect Data Manager to version 20.2.0.0 or later, as directed in Dell advisory DSA-2026-287 (https://www.dell.com/support/kbdoc/en-us/000488847/dsa-2026-287-security-update-dell-powerprotect-data-manager-for-multiple-security-vulnerabilities). Because exploitation requires high privileges, compensating controls until patching is complete include restricting network access to the PPDM management interface to a dedicated administrative VLAN or jump host, tightly limiting and auditing accounts that hold high-privilege/operator roles, and enforcing MFA on those administrative accounts to reduce the chance an attacker obtains the PR:H foothold the flaw depends on; the trade-off is added operational friction for legitimate administrators and no protection against an already-compromised privileged account, making the upgrade the definitive fix.
More in Powerprotect Data Manager
View allElevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Ac
Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information in
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgott
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. Rated high severity (CVSS 8
Dell PowerProtect Data Manager versions prior to 19.22 contain an incorrect privilege assignment flaw that allows remote
Stack buffer overflow (CWE-121) in the file-level restore agent of Dell PowerProtect Data Manager versions 20.2.0.0 and
Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Ele
Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, r
Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authent
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. Rated h
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today