All vulnerabilities
CVE-2026-22769

Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability

Dell RecoverPoint for Virtual Machines (RP4VMs)
Open in ThreatlineRecord JSON
CVSS
10.0Critical
ExploitationExploited in the wildAdded to KEV 18 Feb 2026CISA KEV
Exploit odds (EPSS)13.5%Chance of exploitation activity in the next 30 days, higher than 96% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in6.0.3.1 HF1Fixed versionCVE List
Federal deadline21 Feb 2026Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 6.0.3.1 HF1RecoverPoint for Virtual MachinesCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 17 Feb 2026, 19:19 UTCPublishedCVE List
  2. 18 Feb 2026Added to CISA KEVCISA KEV

Description

Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.

Text from CVE List

Affected versions 2

  • RecoverPoint for Virtual Machinesaffected: 5.3 SP4 P1 before 6.0.3.1 HF1CVE List
  • RecoverPoint for Virtual Machinesaffected: 6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, and 6.0 SP3 P1 before 6.0.3.1 HF1CVE List

References 5