Product:
PowerProtect Data Manager
Summary
Dell PowerProtect Data Manager, versions prior to 19.22, contain an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges. This could allow unauthorized users to gain higher access levels within the system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.1 | CVE-2026-22267 |
Exploitation
To exploit this vulnerability, an attacker with low privileges and remote access can send specially crafted requests to the affected system. By leveraging the Incorrect Privilege Assignment, the attacker can escalate their privileges, potentially gaining unauthorized access to sensitive data or system functionalities.
Affected Products
- PowerProtect Data Manager: Versions prior to 19.22 are affected by the privilege escalation vulnerability.
Mitigation
To mitigate this vulnerability, users should upgrade to PowerProtect Data Manager version 19.22 or later. Additionally, implementing strict access controls and monitoring for unusual activities can help reduce the risk of exploitation.