—–BEGIN PGP SIGNED MESSAGE—–

Hash: SHA256

Authentication Bypass Vulnerability in Dell RecoverPoint for Virtual Machines (RP4VM)

Indian – Computer Emergency Response Team (https://www.cert-in.org.in)

Severity Rating: CRITICAL

Software Affected

Dell RecoverPoint for Virtual Machines (RP4VM) versions prior to 6.0.3.1 HF1

Overview

An authentication bypass vulnerability has been reported in Dell RecoverPoint for Virtual Machines, which could allow an unauthenticated remote attacker to gain unauthorized access to the affected system.

Target Audience:

All organizations and individuals using Dell RecoverPoint for Virtual Machines (RP4VM).

Impact Assessment:

Potential for unauthorized remote access, which may lead to complete system compromise.

Risk Assessment:

High risk of system compromise due to authentication bypass vulnerability.

Description

Dell RecoverPoint for Virtual Machines is a hypervisor-based data protection and disaster recovery solution designed specifically for virtualized environments. It provides continuous data protection (CDP) and replication for VMware virtual machines, enabling organizations to recover data to any point in time with minimal data loss.

A vulnerability exists in Dell RecoverPoint for Virtual Machines due to presence of a hardcoded credential. This issue may allow an unauthenticated remote attacker with knowledge of the credential to gain unauthorized access to the underlying operating system and potentially achieve root-level access with persistent control over the affected system.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized access to the affected system.

Note: This vulnerability (CVE-2026-22769) is being exploited in the wild.

Solution

Apply appropriate fixes issued by the vendor.

https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079

Vendor Information

Dell

https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079

References

Bleeping Computer

https://www.bleepingcomputer.com/news/security/chinese-hackers-exploiting-dell-zero-day-flaw-since-mid-2024

CVE Name

CVE-2026-22769

– —

Thanks and Regards,

CERT-In

Incident Response Help Desk

e-mail: incident@cert-in.org.in

Phone: +91-11-22902657

Toll Free Number: 1800-11-4949

Toll Free Fax : 1800-11-6969

Web: http://www.cert-in.org.in

PGP Fingerprint: A768 083E 4475 5725 B81A A379 2156 C0C0 B620 D0B4

PGP Key information:

https://www.cert-in.org.in/s2cMainServlet?pageid=CONTACTUS

Postal address:

Indian Computer Emergency Response Team (CERT-In)

Ministry of Electronics and Information Technology

Government of India

Electronics Niketan

6, C.G.O. Complex

New Delhi-110 003

—–BEGIN PGP SIGNATURE—–

iQIzBAEBCAAdFiEE6r4Iam/Ey0c/KakL3jCgcSdcys8FAmmW9N0ACgkQ3jCgcSdc

ys+PwQ//b5mb/63h0hYjux5zrJh86EDVi+K4sxKXURp+Ak52C5jcoM5HFhOaIZ9B

cEScrC8IoRHZORhPsDibxRRr5ew9+H7RLjLydFL8e4BAW0SleBRY1ISd6R2WU8RI

WfIcLqzKiMVBo+Du51fPbZ0kWKPeH8Q9c5l6amVugUozEStFgS2xrxemFsxIl/7M

MVpi5YPAY1zp5DT2OhqoEzp14kM0CAVmqI3QjYpjbUTmEC74UCun/eWYEhtFZPxm

D56Nznzs+IDGF/wBk5nu2ewtt6aHD23xDLwltqGKybXShsGnYOY2QMIs8gjjOY5F

4rxAwvh6y9oMmvNtLSYGwQt7NqUh/wf72erMYdqBxSqSb1Ftob7wOP59iGPHZhwT

eLIXfoJ495d9brhXEtJYM0bba5CEdJ4prbUhHIbDgSSNlBilLBpfKags5A7FWRUd

QFEiyUVmu1jCqA+r83zPjStrzj3HL3G12O4jt8AZ6kjFlQtVdyCKnJ61xoxZ26qq

7221XbMT4dL0ugGLJElwVGYINZIdgB1fWSp8vfdvrPPE9Tpsojut5pZxJdnqCXRV

ANSfEhsb7x8SME3mwQ19TBVEmxanNS/QgcDZv4pDcF8D0ZR374GxqTsXMyQxiSqg

y5b84no/S4sr9Q6N1JOLENu7Bzo/F/S36gWaJkqewLYIS3MTXzo=

=4aIQ

—–END PGP SIGNATURE—–