PT-2026-20303 · Dell+1 · Dell Recoverpoint For Virtual Machines+1

Daniel Sislo

+8

·

Published

2026-02-17

·

Updated

2026-05-08

·

CVE-2026-22769

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1
Description Dell RecoverPoint for Virtual Machines contains a critical vulnerability (CVE-2026-22769) due to hardcoded credentials. This allows unauthenticated remote attackers to gain root-level access to the underlying operating system and potentially compromise VMware backup and disaster recovery infrastructure. The vulnerability has been actively exploited since mid-2024 by a China-linked threat actor (UNC6201, also associated with Silk Typhoon). Attackers have used this access to deploy malware, including SLAYSTYLE, BRICKSTORM, and GRIMBOLT, and to move laterally within compromised networks. The exploitation involves accessing the Tomcat Manager interface with hardcoded credentials and deploying malicious web applications. The threat actors have also employed techniques like "Ghost NICs" to evade detection. CISA has ordered federal agencies to patch this vulnerability within three days.
Recommendations Upgrade Dell RecoverPoint for Virtual Machines to version 6.0.3.1 HF1 or later. Apply the remediations provided by Dell. Hunt for indicators of compromise related to the malware families (SLAYSTYLE, BRICKSTORM, GRIMBOLT) and malicious activity within Tomcat Manager logs. Restrict access to the Tomcat Manager interface.

Fix

RCE

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2026-01883
CVE-2026-22769

Affected Products

Apache Tomcat
Dell Recoverpoint For Virtual Machines