Critical Zero-Day in Dell RecoverPoint Exploited for Two Years

A critical zero-day vulnerability in Dell RecoverPoint for Virtual Machines, identified as CVE-2026-22769, has been actively exploited in the wild for nearly two years, raising significant security concerns. This flaw, which has been assigned a maximum CVSS score of 10, involves hardcoded credentials that could allow unauthenticated remote attackers to gain unauthorized access to affected systems. The vulnerability affects versions prior to 6.0.3.1 HF1 of the software. The exploitation of this vulnerability predates its public disclosure, with reports indicating that attackers have been leveraging it since mid-2024. This makes it a particularly dangerous zero-day, as it was actively used in attacks well before any mitigation measures could be implemented by affected organizations. The vulnerability was officially published on February 17, 2026, and added to the Known Exploited Vulnerabilities (KEV) catalog by CISA on February 18, 2026, underscoring its critical nature and the urgency for remediation. Dell RecoverPoint for Virtual Machines is a widely used data protection solution, and the presence of hardcoded credentials represents a severe security oversight. Attackers with knowledge of these credentials can exploit the vulnerability to gain unauthorized access, potentially leading to data breaches or further exploitation within compromised networks. The exploitation of this vulnerability has been linked to sophisticated threat actors, with some reports suggesting involvement by China-linked groups, although specific attribution remains unconfirmed. The Exploit Prediction Scoring System (EPSS) for CVE-2026-22769 is 0.188, indicating a moderate likelihood of exploitation, which is consistent with the observed active exploitation in the wild. The Stakeholder-Specific Vulnerability Categorization (SSVC) has categorized this vulnerability as "act," meaning immediate action is required to address the threat. Organizations using Dell RecoverPoint for Virtual Machines are urged to upgrade to version 6.0.3.1 HF1 or later to mitigate this vulnerability. Given the critical nature of the flaw and its active exploitation, patching should be prioritized to prevent unauthorized access and potential data compromise. Security teams should also review access logs and network traffic for signs of unauthorized access attempts, particularly those originating from known threat actor IP addresses. In light of this vulnerability's exploitation history and the potential impact on data integrity and confidentiality, organizations must act swiftly to secure their systems. The disclosure of CVE-2026-22769 highlights the ongoing challenges in managing software vulnerabilities and the importance of timely patching and vulnerability management practices.