CVE-2026-46738
Dell PowerProtect Data Manager versions before 20.2.0.0 have a flaw that lets a remote attacker with high privileges gain elevated access. The vulnerability is in the REST API and can be triggered without user interaction.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Dell PowerProtect Data Manager, all releases earlier than 20.2.0.0.
Real-world impact
An attacker who can reach the system remotely and already has high privileges could use this flaw to increase their privileges, potentially taking full control of the affected system.
Why this severity
The CVSS score of 9.1 reflects that the flaw can be exploited remotely (AV:N), requires low effort (AC:L), and gives an attacker high privileges (PR:H). Because the attacker can gain complete control, the impact on confidentiality, integrity, and availability is considered high.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 22, 2026 · 10d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- dell.com/support/kbdoc/en-us/0004888…vendor advisory