CVE-2026-74768
MediumCVSS 4.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.
Risk Assessment
A high-privileged attacker can send requests from the server to internal resources, potentially leading to disclosure of sensitive information or further attacks.
Recommendation
Update Dell PowerProtect Data Manager to a patched version. Restrict access to the REST API and filter outbound requests.
Other vulnerabilities in Dell PowerProtect Data Manager
See all- CVE-2026-46738Critical
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could exploit this vulnerability, leading to privilege escalation.
- CVE-2026-40712Critical
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could exploit this vulnerability, leading to privilege escalation.
- CVE-2026-74769Medium
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass.
- CVE-2026-73600High
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.
- CVE-2026-68860Medium
Dell PowerProtect Data Manager versions 20.2.0.0 and below contain a Reliance on Data/Memory Layout vulnerability. An unauthenticated remote attacker could exploit it to launch phishing attacks.
- CVE-2026-49499High
Vulnerability in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) in the IAM component generates incorrect security tokens. A low-privileged remote attacker can escalate privileges.
- CVE-2026-46737Medium
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability to achieve remote code execution.
- CVE-2026-44276Medium
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the REST API. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
- CVE-2026-40714High
Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability. A high privileged attacker with remote access could exploit this to achieve privilege escalation.
Original NVD description (English source)
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.