CVE-2026-49809
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
Risk Assessment
The risk includes the possibility of disclosing sensitive data stored in the database, which may lead to confidentiality breach.
Recommendation
It is recommended to upgrade Dell PowerProtect Cyber Recovery to a version later than 20.2 to fix the vulnerability.
Other vulnerabilities in Dell PowerProtect Cyber Recovery
See all- CVE-2026-79939Medium
Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain a UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection.
- CVE-2026-79938High
Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this, leading to unauthorized access.
Original NVD description (English source)
Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.