CVE-2026-22268

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22268", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2026-01-07T06:43:46.537Z", "datePublished": "2026-02-19T09:12:08.514Z", "dateUpdated": "2026-02-20T16:11:27.190Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "PowerProtect Data Manager", "vendor": "Dell", "versions": [{"lessThan": "19.22.0-24 or later", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "other", "value": "Dell would like to thank brocked200 (Nguyen Quoc Khanh) for reporting these issues."}], "datePublic": "2026-02-17T18:30:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service of a Dell Enterprise Support connection.<br>"}], "value": "Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service of a Dell Enterprise Support connection."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-266", "description": "CWE-266: Incorrect Privilege Assignment", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-02-19T09:12:08.514Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000429778/dsa-2026-046-security-update-for-dell-powerprotect-data-manager-multiple-vulnerabilities"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T16:11:13.947710Z", "id": "CVE-2026-22268", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T16:11:27.190Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22268", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T16:11:13.947710Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T16:11:20.700Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "other", "value": "Dell would like to thank brocked200 (Nguyen Quoc Khanh) for reporting these issues."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "PowerProtect Data Manager", "versions": [{"status": "affected", "version": "N/A", "lessThan": "19.22.0-24 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-02-17T18:30:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000429778/dsa-2026-046-security-update-for-dell-powerprotect-data-manager-multiple-vulnerabilities", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service of a Dell Enterprise Support connection.", "supportingMedia": [{"type": "text/html", "value": "Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service of a Dell Enterprise Support connection.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "CWE-266: Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-02-19T09:12:08.514Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22268", "state": "PUBLISHED", "dateUpdated": "2026-02-20T16:11:27.190Z", "dateReserved": "2026-01-07T06:43:46.537Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2026-02-19T09:12:08.514Z", "assignerShortName": "dell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PowerProtect Data Manager", "vendor": "Dell", "versions": [{"lessThan": "19.22.0-24 or later", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:powerprotect_data_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "17D7AA01-F2D1-4DCF-BF83-0550AA9CC59A", "versionEndExcluding": "19.22", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service of a Dell Enterprise Support connection."}, {"lang": "es", "value": "Dell PowerProtect Data Manager, versi\u00f3n(es) anterior(es) a la 19.22, contiene una vulnerabilidad de asignaci\u00f3n de privilegios incorrecta. Un atacante con privilegios bajos con acceso remoto podr\u00eda potencialmente explotar esta vulnerabilidad, lo que llevar\u00eda a la denegaci\u00f3n de servicio de una conexi\u00f3n de soporte empresarial de Dell."}], "id": "CVE-2026-22268", "lastModified": "2026-06-17T10:19:40.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 4.2, "source": "security_alert@emc.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22268", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T16:11:13.947710Z", "version": "2.0.3"}}]}, "published": "2026-02-19T10:16:11.963", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000429778/dsa-2026-046-security-update-for-dell-powerprotect-data-manager-multiple-vulnerabilities"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,19.22.0-24)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "PowerProtect Data Manager", "source": "cna", "vendor": "Dell"}, "product": "powerprotect_data_manager", "vendor": "dell"}], "analysis": {"en": {"generated_at": "2026-04-17T18:08:17.373903+00:00", "value": {"mitigation_remediation": ["Apply the Dell PowerProtect Data Manager security update DSA-2026-046 to upgrade the product to version 19.22 or newer.", "Revoke excessive permissions and enforce the principle of least privilege so that only authorized users can access the Enterprise Support connection.", "If an immediate upgrade is not feasible, restrict remote access to the PowerProtect Data Manager instance, isolate the service from external networks, and monitor logs for any privilege escalation attempts."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via Incorrect Privilege Assignment"}, "threat_synthesis": {"affected_systems": "Dell PowerProtect Data Manager versions earlier than 19.22 are impacted. The vulnerability applies to any installation of the product that has not been updated to 19.22 or later, regardless of environment.", "description_and_impact": "The vulnerability is an incorrect privilege assignment that permits a low\u2011privileged attacker with remote access to terminate the Dell Enterprise Support connection, causing a service interruption. This flaw is classified as CWE\u2011266, reflecting insufficient access controls that can disrupt availability for the affected system.", "risk_and_exploitability": "The reported CVSS score of 6.3 indicates medium severity, and the EPSS score is below 1\u202f%, suggesting a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, which further implies no known active exploitation. However, a remote attacker with low privileges could attempt to exploit this flaw to disrupt the Enterprise Support connection if network access to the PowerProtect environment is available. The critical factors are the remote access requirement and the lack of proper privilege enforcement."}}}}, "created": "2026-02-20T10:07:48.587562+00:00", "title": "Incorrect Privilege Assignment Leading to Denial of Service in Dell PowerProtect Data Manager", "updated": "2026-04-17T18:15:26.776174+00:00", "vendors": ["dell", "dell$PRODUCT$powerprotect_data_manager"]}