CVE-2026-28264

Information Exposure via Improper Permission Assignment in Dell PowerProtect Agent Service

Published Apr 8, 2026 CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Description

Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

Analysis

Technical impact

The flaw is an incorrect permission assignment that allows a local user with low privileges to access critical resources managed by the Dell PowerProtect Agent Service. This can lead to the exposure of confidential data that the agent processes or stores, representing an information disclosure risk. The weakness corresponds to CWE‑732, which describes improper handling of permissions that permits unauthorized access to sensitive resources.

Affected Systems

Dell PowerProtect Agent Service, versions earlier than 20.1, installed on Dell PowerProtect solutions that include the agent component. Systems that have not yet been upgraded to version 20.1 or later are affected.

Risk and Exploitability

The CVSS base score of 3.3 indicates low severity. The EPSS score is not available, leaving the likelihood of exploitation uncertain. The vulnerability is not listed in the CISA KEV catalog. Because the attack requires local access with a low‑privileged account, the threat is limited to systems that can be accessed physically or remotely with low‑privileged credentials. The overall risk is low to moderate, and remediation by patching is strongly recommended.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Dell

PowerProtect Agent

unaffected

Version	Status	Constraints
`0`	affected	< 20.1.0.0 or later

Configuration 1 [-]

cpe:2.3:a:dell:powerprotect_data_manager:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Dell

Powerprotect Agent

Version	Status	Scheme	Platform
`[0,20.1.0.0)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Dell PowerProtect Data Manager security update to version 20.1 or later.
Verify that the update was installed correctly and that the PowerProtect Agent service restarts successfully.
If patching cannot be performed immediately, restrict local user access to the PowerProtect Agent executable and its related directories to reduce the chance of information exposure.
Monitor system logs for signs of unauthorized data access after remediation.

Generated by OpenCVE AI on April 8, 2026 at 12:50 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.132% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.dell.com/support/kbdoc/en-us/000447277/dsa-2026-158-security-update-dell-powerprotect-data-manager-for-multiple-security-vulnerabilities

History

Jun 2, 2026 6:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dell powerprotect Data Manager
CPEs		cpe:2.3:a:dell:powerprotect_data_manager::::::::
Vendors & Products		Dell powerprotect Data Manager

Apr 9, 2026 8:30 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dell Dell powerprotect Agent
Vendors & Products		Dell Dell powerprotect Agent

Apr 8, 2026 8:15 PM Title updated View changes

Type	Values Removed	Values Added
Title		Information Exposure via Improper Permission Assignment in Dell PowerProtect Agent Service

Apr 8, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 8, 2026 11:45 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
Weaknesses		CWE-732
References		https://www.dell.com/support/kbdoc/en-us/000447277/dsa-2026-158-security-update-dell-powerprotect-data-manager-for-multiple-security-vulnerabilities
Metrics		cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}`