CVE-2026-22769

# CVE-2026-22769: Dell RecoverPoint for Virtual Machines Hard-Coded Credentials Dell RecoverPoint for Virtual Machines (RP4VMs) contains hard-coded credentials in the product code that allow unauthenticated remote attackers to gain unauthorized OS-level access and establish root persistence without requiring valid user credentials. An attacker can exploit this vulnerability to compromise the underlying hypervisor environment, bypass all authentication controls, and maintain persistent access to virtual machines protected by the RecoverPoint appliance—directly affecting backup integrity and business continuity infrastructure. **Actions:** - Identify all RP4VMs deployments in your environment immediately and isolate them from untrusted networks. - Check Dell's security advisory for affected version numbers and apply patches when released. - Review access logs for unauthorized connections to RP4VMs management interfaces and underlying OS accounts. - Implement network segmentation to restrict RP4VMs access to authorized recovery and administrative personnel only. - Monitor for suspicious process execution or persistence mechanisms (cron jobs, systemd units, kernel modules) on affected appliances.