CVE-2026-22769 is a hard-coded credential in Dell RecoverPoint for Virtual Machines' bundled Tomcat configuration that lets a remote, unauthenticated attacker log into the Tomcat Manager with the built-in 'admin' account, deploy a malicious WAR file, and run commands as root on the appliance — and it has been exploited since at least mid-2024 by a suspected PRC-nexus group tracked as UNC6201 to deploy the BRICKSTORM and GRIMBOLT backdoors.
Vulnerability summary
| Vulnerability ID | CVE-2026-22769 |
|---|---|
| CVSS score | 10 |
| EPSS score | 0.1353 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2026-02-17T20:22:09.800 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Dell RecoverPoint for Virtual Machines (RP4VMs) | cpe:2.3:a:dell:recoverpoint_for_virtual_machines:*:*:*:*:*:*:*:* | Versions prior to 6.0 (including 5.3 SP4 P1 and earlier), and 6.0, 6.0 SP1, 6.0 SP1 P1, 6.0 SP1 P2, 6.0 SP2, 6.0 SP2 P1, 6.0 SP3, 6.0 SP3 P1 (fixed in 6.0.3.1 HF1; 5.3-line systems must migrate to 6.0 SP3 before applying the hotfix) |
What this means
CVE-2026-22769 (CWE-798, use of hard-coded credentials) affects Dell RecoverPoint for Virtual Machines (RP4VMs). Dell's advisory states the product "contain[s] a hardcoded credential vulnerability," and that "an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence" (Dell Security Advisory DSA-2026-079).
Both NVD's own analysis and the Dell/EMC CNA submission agree on severity: CVSS v3.1 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, scope-changed, with high impact to confidentiality, integrity and availability (NVD).
Google Threat Intelligence Group's analysis of the exploitation (published alongside Dell's advisory) found the hard-coded credential belongs to the 'admin' user defined in /home/kos/tomcat9/tomcat-users.xml, and that the attacker, tracked as UNC6201, authenticates to the exposed Tomcat Manager and deploys a malicious WAR file via the /manager/text/deploy endpoint to execute commands as root. The group documents exploitation dating to at least mid-2024, deployment of the SLAYSTYLE web shell followed by the BRICKSTORM and GRIMBOLT backdoors, and a persistence mechanism that modifies /home/kos/kbox/src/installation/distribution/convert_hosts.sh so the backdoor re-launches at boot; BRICKSTORM binaries were swapped for GRIMBOLT in victim environments in September 2025 (Google Cloud Threat Intelligence: UNC6201 Exploiting Dell RecoverPoint Zero-Day).
CISA added CVE-2026-22769 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-02-18, with a required-action due date of 2026-02-21 — a three-day window reflecting confirmed in-the-wild exploitation (CISA KEV).
Dell's fix is version 6.0.3.1 HF1; systems on the older 5.3 line must first be migrated to 6.0 SP3 before the hotfix can be applied, and Dell also published a standalone remediation script for environments that cannot upgrade immediately (Dell KB 000426742: Apply the Remediation Script for DSA-2026-079).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.1353 (96.444th percentile) (FIRST EPSS).
Given the documented backdoor deployment, any RecoverPoint for VMs appliance on an affected build should be upgraded immediately and inspected for the indicators of compromise Google's advisory lists, not just patched.
Evidence
- Dell RecoverPoint for Virtual Machines contains a hard-coded credential that lets an unauthenticated remote attacker gain unauthorized OS access and root-level persistence. — Dell Security Advisory DSA-2026-079
- CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, agreed by both NVD's own analysis and the Dell/EMC CNA submission. — NVD
- The hard-coded 'admin' Tomcat credential lets UNC6201 deploy a malicious WAR file via /manager/text/deploy for root code execution; exploitation dates to mid-2024 with SLAYSTYLE, BRICKSTORM and GRIMBOLT malware deployed, persisting via a modified convert_hosts.sh boot script. — Google Cloud Threat Intelligence
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-02-18, with a required-action due date of 2026-02-21. — CISA KEV
- Fixed in version 6.0.3.1 HF1; 5.3-line systems must first migrate to 6.0 SP3; a standalone remediation script is available for environments that cannot upgrade immediately. — Dell KB 000426742
- EPSS score is 0.1353 (96.444th percentile) as of 2026-10-29. — FIRST EPSS