CVE-2026-40712
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could exploit this vulnerability, leading to privilege escalation.
Risk Assessment
Risk of privilege escalation by a privileged attacker, potentially leading to unauthorized access to critical data and systems.
Recommendation
Immediately upgrade to version 20.2.0.0 or later and restrict REST API access to trusted users only.
Original NVD description (English source)
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.