CVE-2026-22769: Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability

This vulnerability affects Dell RecoverPoint for Virtual Machines (RP4VMs). It stems from the use of hard-coded credentials and could allow an unauthenticated remote attacker to reach the underlying operating system with root-level persistence.

How it works

The weakness is categorized as CWE-798, use of hard-coded credentials. In products of this class an embedded credential set remains present in the software image or configuration. An attacker who knows or discovers the value can supply it directly over the network without prior authentication. Successful use grants a shell or equivalent access on the host operating system and the ability to establish persistent root-level control.

Am I affected? How to find it in your systems

• Locate all deployments of Dell RecoverPoint for Virtual Machines, typically installed in virtualization environments that perform continuous data replication and recovery.
• Inventory instances through your virtualization management console, asset-management database, or by querying for the RP4VMs management virtual machines and associated storage components.
• Compare installed builds and configuration settings against the details listed in the vendor advisory; no public list of affected versions is provided here.
• Review authentication logs, remote-access service logs, and any exposed management ports for unexpected successful logins that bypass normal credential stores.

How to remediate

Apply the vendor-supplied update referenced in the official advisory. After patching, review and, where supported, replace or disable any remaining static credential mechanisms used by management or replication services. Follow the vendor’s hardening checklist for the product class, which commonly includes restricting management interfaces to trusted networks and enforcing certificate-based or multi-factor authentication where the software permits.

If you can't patch immediately

• Apply mitigations exactly as described in the vendor instructions.
• If the deployment uses cloud-hosted components, follow the requirements of CISA BOD 22-01.
• When mitigations cannot be implemented, discontinue use of the affected product until an update can be applied.
• Restrict network reachability to the management and replication ports through firewall rules or micro-segmentation so that only authorized orchestration hosts can connect.
• Enable or increase logging on any remote-access services and forward those logs to a monitored SIEM for detection of anomalous authentication attempts.

If your data may have been exposed

Compromise of systems that hold replication and recovery data can lead to unauthorized access or destruction of protected workloads. Organizations that discover an active intrusion should assume credentials and persisted access may have been obtained. You can run a free exposure scan of your email addresses against known breach data to check for related account exposure.