{"id":"dell-recoverpoint-hardcoded-credentials-feb-2026","category":"patch","status":"closed","title":"Dell RecoverPoint for Virtual Machines hard-coded password flaw CVE-2026-22769 exploited","tldr":"Attackers used a built-in password to take over Dell RecoverPoint for Virtual Machines business systems. Ask IT to install 6.0.3.1 HF1 or apply Dell's remediation script, and investigate for existing compromise.","summary":"CVE-2026-22769 affects Dell RecoverPoint for Virtual Machines, used in business virtual-machine recovery environments. A password built into the software lets a remote attacker who knows it gain operating-system access and maintain control with the highest privileges, without an authorised customer login. Mandiant reported exploitation since at least mid-2024 by UNC6201, a suspected China-linked group, including persistent backdoors and movement into other systems. Dell disclosed the flaw and remediation on 17 February 2026; CISA listed it as exploited the next day. Release 6.0.3.1 HF1 fixes the vulnerability, with a remediation script available as an alternative for specified older releases. Dell's March guidance says the script must also cover newly deployed or reimaged older appliances. Remediation and investigation for installed backdoors are separate tasks; the reviewed sources do not establish that the campaign has ended.","action":"If your business or family office uses RecoverPoint for Virtual Machines, ask IT to upgrade to 6.0.3.1 HF1 or apply Dell's script to every appliance, following Dell's upgrade path for older releases. Ask the security team to investigate for existing compromise using Mandiant's guidance.","product":"Dell RecoverPoint for Virtual Machines (RP4VMs)","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-22769"],"tags":["dell","recoverpoint","vmware","hardcoded-credentials","zero-day"],"affected":["RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1","Dell specifically lists 5.3 SP4 P1; 6.0; 6.0 SP1; 6.0 SP1 P1; 6.0 SP1 P2; 6.0 SP2; 6.0 SP2 P1; 6.0 SP3; and 6.0 SP3 P1","Dell also identifies 5.3 SP4, 5.3 SP3, 5.3 SP2 and potentially earlier versions"],"fixed":["RecoverPoint for Virtual Machines 6.0.3.1 HF1"],"matches":[],"sources":[{"kind":"advisory","title":"DSA-2026-079: Security Update for RecoverPoint for Virtual Machines Hardcoded Credential Vulnerability","url":"https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079","by":"Dell","date":"2026-02-17"},{"kind":"advisory","title":"RecoverPoint for Virtual Machines: Apply the remediation script for DSA-2026-079","url":"https://www.dell.com/support/kbdoc/en-us/000426742/recoverpoint-for-vms-apply-the-remediation-script-for-dsa","by":"Dell","date":"2026-03-18"},{"kind":"research","title":"From BRICKSTORM to GRIMBOLT: UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day","by":"Google Threat Intelligence Group / Mandiant","date":"2026-02-17"},{"kind":"advisory","title":"Dell security advisory (AV26-138) – Update 1","url":"https://www.cyber.gc.ca/en/alerts-advisories/dell-security-advisory-av26-138","by":"Canadian Centre for Cyber Security","date":"2026-02-18"},{"kind":"advisory","title":"Critical Vulnerability in Dell RecoverPoint for Virtual Machines","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-016/","by":"Cyber Security Agency of Singapore","date":"2026-02-20"}],"started":"2026-02-17","closed":"2026-03-18","created":"2026-11-03T22:27:28.932Z","updated":"2026-11-03T22:27:28.932Z","cve_notes":[{"cve":"CVE-2026-22769","name":"Hard-coded credentials in Dell RecoverPoint for VMs","what":"A built-in credential in Dell RecoverPoint for Virtual Machines before 6.0.3.1 HF1 lets a remote attacker who knows it access the underlying operating system and establish persistent access with full administrative privileges.","severity":"critical","cvss":10}],"timeline":[{"at":"2026-03-18","added":"2026-11-03T22:23:55.101Z","kind":"vendor-revised","text":"Dell's script guidance was last updated on this date. It says the procedure must be repeated after reimaging appliances running 6.0 SP3 P1 or older, and applied to newly deployed appliances on those versions.","url":"https://www.dell.com/support/kbdoc/en-us/000426742/recoverpoint-for-vms-apply-the-remediation-script-for-dsa","by":"Dell","patch":null},{"at":"2026-02-18","added":"2026-11-03T22:23:55.101Z","kind":"cisa-added","text":"CISA added CVE-2026-22769 to its Known Exploited Vulnerabilities catalogue, as confirmed by the Canadian Centre for Cyber Security.","url":"https://www.cyber.gc.ca/en/alerts-advisories/dell-security-advisory-av26-138","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-02-17","added":"2026-11-03T22:23:55.101Z","kind":"new-fix","text":"Dell published DSA-2026-079, confirming limited active exploitation and providing fixed release 6.0.3.1 HF1 or a remediation script.","url":"https://www.dell.com/support/kbdoc/en-us/000426773/dsa-2026-079","by":"Dell","patch":"patched"},{"at":"2026-02-17","added":"2026-11-03T22:23:55.101Z","kind":"disclosed","text":"Mandiant disclosed CVE-2026-22769, reporting exploitation by suspected China-linked group UNC6201 since at least mid-2024. Attackers installed persistent backdoors, replacing BRICKSTORM with GRIMBOLT in September 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc6201-exploiting-dell-recoverpoint-zero-day","by":"Google Threat Intelligence Group / Mandiant","patch":null}],"url":"https://hard.fyi/live/dell-recoverpoint-hardcoded-credentials-feb-2026/","json":"https://hard.fyi/api/live?id=dell-recoverpoint-hardcoded-credentials-feb-2026"}