Powerprotect Data Manager
Monthly
Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation in the product's REST API, allowing a high-privileged, remotely authenticated attacker to escalate into arbitrary code execution on the data-protection appliance. Dell (the reporting vendor) rates it CVSS 7.2 (High) with full confidentiality, integrity, and availability impact but requiring high privileges (PR:H). There is no public exploit identified at time of analysis, the EPSS probability is low (0.61%, 46th percentile), and CISA SSVC marks exploitation status as none.
Elevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Access Management (IAM) subsystem generating incorrect security tokens, letting an already-authenticated low-privileged user obtain rights beyond those granted to their account. The flaw is remotely reachable over the network and requires no user interaction, and while the CVSS base score is 8.8 (High), there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the impact is full compromise of confidentiality, integrity and availability of the data-protection platform, it should be prioritized in any environment running affected versions.
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, remotely authenticated attacker to abuse improper input validation in the REST API to gain further control over the appliance. Exploitation yields total technical impact (full confidentiality, integrity, and availability compromise) but requires existing high privileges, keeping practical risk moderate. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authenticated attacker abuse an improperly validated REST API input to gain further control over the backup and recovery appliance. Per the CVSS vector the attacker starts with high privileges (PR:H), yet the flaw yields total confidentiality, integrity, and availability impact on the affected system. There is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with a low EPSS probability of 0.50%.
Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged attacker to abuse improper input validation and gain elevated privileges, with full confidentiality, integrity, and availability impact per the CVSS vector. The flaw was reported by Dell, which has published advisory DSA-2026-287 and a fixed release. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently limited by the requirement for pre-existing high privileges.
Dell PowerProtect Data Manager's REST API exposes sensitive information to high-privileged local users in all versions prior to 20.2.0.0. An administrator-level attacker with local access can query the REST API and retrieve sensitive data that should be restricted even at the admin tier - with the CVSS Scope:Changed indicator suggesting the exposed information may include credentials or secrets belonging to systems external to the PPDM instance itself. No public exploit code or active exploitation has been identified at time of analysis; Dell has released version 20.2.0.0 to address this and multiple other vulnerabilities per advisory DSA-2026-287.
Dell PowerProtect Data Manager versions prior to 19.22 contain a privilege assignment flaw that allows low-privileged remote attackers to disrupt Enterprise Support connections, resulting in denial of service. Exploitation requires valid credentials and user interaction, and no patch is currently available. The vulnerability affects system availability rather than confidentiality or data integrity.
Dell PowerProtect Data Manager versions prior to 19.22 contain an incorrect privilege assignment flaw that allows remote attackers with low-level credentials to escalate their privileges on affected systems. The vulnerability requires network access and valid authentication but no user interaction, making it exploitable by insiders or attackers who have obtained legitimate credentials. No patch is currently available.
Dell PowerProtect Data Manager versions prior to 19.22 contain improper verification of communication channels in the REST API, allowing high-privileged remote attackers to bypass security protections. The vulnerability requires administrative credentials but carries no patch availability, creating ongoing risk for affected deployments.
Dell PowerProtect Data Manager versions prior to 19.22 contain improper verification of REST API communication channels that allows high-privileged remote attackers to bypass security protections. The vulnerability requires administrative credentials and network access, enabling authenticated attackers to circumvent established security controls. No patch is currently available.
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Plaintext Storage of a Password vulnerability. Rated medium severity (CVSS 5.0). No vendor patch available.
Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information into Log File vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Incorrect Default Permissions vulnerability. Rated high severity (CVSS 7.0). No vendor patch available.
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Path Traversal: '.../...//' vulnerability. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager, Generic Application Agent, version(s) 19.19 and 19.20, contain(s) an Incorrect Default Permissions vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding or Escaping of Output vulnerability. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. Rated low severity (CVSS 2.3), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgotten passwords. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager (PPDM) versions prior to 19.4 and Dell PowerProtect X400 versions prior to 3.2 contain an improper authorization vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation in the product's REST API, allowing a high-privileged, remotely authenticated attacker to escalate into arbitrary code execution on the data-protection appliance. Dell (the reporting vendor) rates it CVSS 7.2 (High) with full confidentiality, integrity, and availability impact but requiring high privileges (PR:H). There is no public exploit identified at time of analysis, the EPSS probability is low (0.61%, 46th percentile), and CISA SSVC marks exploitation status as none.
Elevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Access Management (IAM) subsystem generating incorrect security tokens, letting an already-authenticated low-privileged user obtain rights beyond those granted to their account. The flaw is remotely reachable over the network and requires no user interaction, and while the CVSS base score is 8.8 (High), there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the impact is full compromise of confidentiality, integrity and availability of the data-protection platform, it should be prioritized in any environment running affected versions.
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, remotely authenticated attacker to abuse improper input validation in the REST API to gain further control over the appliance. Exploitation yields total technical impact (full confidentiality, integrity, and availability compromise) but requires existing high privileges, keeping practical risk moderate. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authenticated attacker abuse an improperly validated REST API input to gain further control over the backup and recovery appliance. Per the CVSS vector the attacker starts with high privileges (PR:H), yet the flaw yields total confidentiality, integrity, and availability impact on the affected system. There is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with a low EPSS probability of 0.50%.
Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged attacker to abuse improper input validation and gain elevated privileges, with full confidentiality, integrity, and availability impact per the CVSS vector. The flaw was reported by Dell, which has published advisory DSA-2026-287 and a fixed release. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently limited by the requirement for pre-existing high privileges.
Dell PowerProtect Data Manager's REST API exposes sensitive information to high-privileged local users in all versions prior to 20.2.0.0. An administrator-level attacker with local access can query the REST API and retrieve sensitive data that should be restricted even at the admin tier - with the CVSS Scope:Changed indicator suggesting the exposed information may include credentials or secrets belonging to systems external to the PPDM instance itself. No public exploit code or active exploitation has been identified at time of analysis; Dell has released version 20.2.0.0 to address this and multiple other vulnerabilities per advisory DSA-2026-287.
Dell PowerProtect Data Manager versions prior to 19.22 contain a privilege assignment flaw that allows low-privileged remote attackers to disrupt Enterprise Support connections, resulting in denial of service. Exploitation requires valid credentials and user interaction, and no patch is currently available. The vulnerability affects system availability rather than confidentiality or data integrity.
Dell PowerProtect Data Manager versions prior to 19.22 contain an incorrect privilege assignment flaw that allows remote attackers with low-level credentials to escalate their privileges on affected systems. The vulnerability requires network access and valid authentication but no user interaction, making it exploitable by insiders or attackers who have obtained legitimate credentials. No patch is currently available.
Dell PowerProtect Data Manager versions prior to 19.22 contain improper verification of communication channels in the REST API, allowing high-privileged remote attackers to bypass security protections. The vulnerability requires administrative credentials but carries no patch availability, creating ongoing risk for affected deployments.
Dell PowerProtect Data Manager versions prior to 19.22 contain improper verification of REST API communication channels that allows high-privileged remote attackers to bypass security protections. The vulnerability requires administrative credentials and network access, enabling authenticated attackers to circumvent established security controls. No patch is currently available.
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Plaintext Storage of a Password vulnerability. Rated medium severity (CVSS 5.0). No vendor patch available.
Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information into Log File vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Incorrect Default Permissions vulnerability. Rated high severity (CVSS 7.0). No vendor patch available.
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) a Path Traversal: '.../...//' vulnerability. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager, version(s) 19.19 and 19.20, Hyper-V contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager, Generic Application Agent, version(s) 19.19 and 19.20, contain(s) an Incorrect Default Permissions vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager Reporting, version(s) 19.17, 19.18 contain(s) an Improper Encoding or Escaping of Output vulnerability. Rated medium severity (CVSS 4.2), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager Reporting, version(s) 19.16, 19.17, 19.18, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. Rated low severity (CVSS 2.3), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager Reporting, version(s) 19.17, contain(s) an Incorrect Use of Privileged APIs vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgotten passwords. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Dell PowerProtect Data Manager (PPDM) versions prior to 19.4 and Dell PowerProtect X400 versions prior to 3.2 contain an improper authorization vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.