In CISA KEV10.0 CriticalCWE-798
CVE-2026-22769
Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability
DellRecoverPoint for Virtual Machines (RP4VMs)
Status
- Exploited in the wild
- In CISA KEV since 18 Feb
- Vendor fix available
Federal deadlineSat 21 Feb, 23:59 UTC
Passed 245 days ago
CISA KEV · added 18 Feb
Exploit probabilityEPSSchecked 25 Oct
14%probability of exploitation in the next 30 days
Higher than 96% of scored CVEs
SeverityCVSS
10.0Critical
Description NVD
Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage 6 articles · 5 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 18 Feb · 07:31 UTC | SecurityWeek | Dell RecoverPoint Zero-Day Exploited by Chinese Cyberespionage Group |
| Wed 18 Feb · 11:51 UTC | The Hacker News | Dell RecoverPoint for VMs Zero-Day CVE-2026-22769 Exploited Since Mid-2024 |
| Wed 18 Feb · 12:56 UTC | Security Affairs | China-linked APT weaponized Dell RecoverPoint zero-day since 2024 |
| Wed 18 Feb · 21:16 UTC | Dark Reading | Dell's Hard-Coded Flaw: A Nation-State Goldmine |
| Thu 19 Feb · 15:45 UTC | Security Affairs | U.S. CISA adds Dell RecoverPoint and GitLab flaws to its Known Exploited Vulnerabilities catalog |
| Wed 25 Feb · 15:57 UTC | Google Cloud | CVE-2026-22769 in Dell RecoverPoint used to install GRIMBOLT |
- CVE-2026-22769 in Dell RecoverPoint used to install GRIMBOLTGoogle Cloud
- U.S. CISA adds Dell RecoverPoint and GitLab flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · mentions it in passing
- Dell's Hard-Coded Flaw: A Nation-State GoldmineDark Reading
- China-linked APT weaponized Dell RecoverPoint zero-day since 2024Security Affairs
- Dell RecoverPoint for VMs Zero-Day CVE-2026-22769 Exploited Since Mid-2024The Hacker News
- Dell RecoverPoint Zero-Day Exploited by Chinese Cyberespionage GroupSecurityWeek · first in our coverage