NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Dell RecoverPoint for Virtual Machines hard-coded password flaw CVE-2026-22769 exploited

Attackers used a built-in password to take over Dell RecoverPoint for Virtual Machines business systems. Ask IT to install 6.0.3.1 HF1 or apply Dell's remediation script, and investigate for existing compromise.

What to do

If your business or family office uses RecoverPoint for Virtual Machines, ask IT to upgrade to 6.0.3.1 HF1 or apply Dell's script to every appliance, following Dell's upgrade path for older releases. Ask the security team to investigate for existing compromise using Mandiant's guidance.

What’s happening

CVE-2026-22769 affects Dell RecoverPoint for Virtual Machines, used in business virtual-machine recovery environments. A password built into the software lets a remote attacker who knows it gain operating-system access and maintain control with the highest privileges, without an authorised customer login. Mandiant reported exploitation since at least mid-2024 by UNC6201, a suspected China-linked group, including persistent backdoors and movement into other systems. Dell disclosed the flaw and remediation on 17 February 2026; CISA listed it as exploited the next day. Release 6.0.3.1 HF1 fixes the vulnerability, with a remediation script available as an alternative for specified older releases. Dell's March guidance says the script must also cover newly deployed or reimaged older appliances. Remediation and investigation for installed backdoors are separate tasks; the reviewed sources do not establish that the campaign has ended.

What
Flaw
Affects
Dell RecoverPoint for Virtual Machines (RP4VMs)
Affected
RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1
Dell specifically lists 5.3 SP4 P1; 6.0; 6.0 SP1; 6.0 SP1 P1; 6.0 SP1 P2; 6.0 SP2; 6.0 SP2 P1; 6.0 SP3; and 6.0 SP3 P1
Dell also identifies 5.3 SP4, 5.3 SP3, 5.3 SP2 and potentially earlier versions
Fixed in
RecoverPoint for Virtual Machines 6.0.3.1 HF1
CVE
CVE-2026-22769
Since
17 Feb 2026
Closed
18 Mar 2026

Timeline

  1. Vendor revised

    Dell's script guidance was last updated on this date. It says the procedure must be repeated after reimaging appliances running 6.0 SP3 P1 or older, and applied to newly deployed appliances on those versions.

  2. CISA added

    CISA added CVE-2026-22769 to its Known Exploited Vulnerabilities catalogue, as confirmed by the Canadian Centre for Cyber Security.

  3. New fixFixed

    Dell published DSA-2026-079, confirming limited active exploitation and providing fixed release 6.0.3.1 HF1 or a remediation script.

  4. Made public

    Mandiant disclosed CVE-2026-22769, reporting exploitation by suspected China-linked group UNC6201 since at least mid-2024. Attackers installed persistent backdoors, replacing BRICKSTORM with GRIMBOLT in September 2025.

Sources

  1. DSA-2026-079: Security Update for RecoverPoint for Virtual Machines Hardcoded Credential VulnerabilityDell · 17 Feb 2026
  2. RecoverPoint for Virtual Machines: Apply the remediation script for DSA-2026-079Dell · 18 Mar 2026
  3. From BRICKSTORM to GRIMBOLT: UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-DayGoogle Threat Intelligence Group / Mandiant · 17 Feb 2026
  4. Dell security advisory (AV26-138) – Update 1Canadian Centre for Cyber Security · 18 Feb 2026
  5. Critical Vulnerability in Dell RecoverPoint for Virtual MachinesCyber Security Agency of Singapore · 20 Feb 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from February 2026 · JSON · RSS