CVE-2026-40714
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability. A high privileged attacker with remote access could exploit this to achieve privilege escalation.
Risk Assessment
An attacker with high privileges can escalate their privileges within the system, potentially leading to full compromise of the data protection environment.
Recommendation
Update Dell PowerProtect Data Manager to version 20.2.0.0 or later to remediate the vulnerability.
Other vulnerabilities in Dell PowerProtect Data Manager
See all- CVE-2026-46738Critical
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could exploit this vulnerability, leading to privilege escalation.
- CVE-2026-40712Critical
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could exploit this vulnerability, leading to privilege escalation.
- CVE-2026-49499High
Vulnerability in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) in the IAM component generates incorrect security tokens. A low-privileged remote attacker can escalate privileges.
- CVE-2026-46737Medium
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability to achieve remote code execution.
- CVE-2026-44276Medium
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the REST API. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
Original NVD description (English source)
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.