Description
Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.
Published: 2026-02-19
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Protection Mechanism Bypass
Action: Patch
AI Analysis

Impact

The vulnerability is an improper verification of the source of a communication channel in the REST API of Dell PowerProtect Data Manager, allowing a high‑privileged attacker with remote access to create an unverified channel that the service accepts, thereby bypassing the protection mechanism that safeguards the data manager.

Affected Systems

Dell PowerProtect Data Manager versions prior to 19.22, exposed through its network‑facing REST API.

Risk and Exploitability

The CVSS score of 4.7 indicates moderate severity. The EPSS score is less than 1%, showing a very low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote network access to the REST API, and an attacker would need high‑privileged credentials to exploit the flaw.

Generated by OpenCVE AI on April 18, 2026 at 11:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Dell PowerProtect Data Manager update that includes the fix for this issue (see DSA‑2026‑046).
  • If the patch cannot be applied immediately, restrict access to the REST API and enforce least privilege on accounts that use it.
  • Enable logging and anomaly detection for REST API traffic to identify attempts to establish unauthorized channels promptly.

Generated by OpenCVE AI on April 18, 2026 at 11:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 18 Apr 2026 12:15:00 +0000

Type Values Removed Values Added
Title Improper Source Verification in Dell PowerProtect REST API Allows Protection Bypass

Fri, 20 Feb 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 20 Feb 2026 16:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:dell:powerprotect_data_manager:*:*:*:*:*:*:*:*

Fri, 20 Feb 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell powerprotect Data Manager
Vendors & Products Dell
Dell powerprotect Data Manager

Thu, 19 Feb 2026 09:30:00 +0000

Type Values Removed Values Added
Description Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.
Weaknesses CWE-146
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Dell Powerprotect Data Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-02-20T16:10:51.265Z

Reserved: 2026-01-07T06:43:46.536Z

Link: CVE-2026-22266

cve-icon Vulnrichment

Updated: 2026-02-20T16:10:44.780Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-19T10:16:11.630

Modified: 2026-02-20T16:36:07.650

Link: CVE-2026-22266

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T12:00:05Z

Weaknesses