PatchSiren cyber security CVE debrief

CVE-2026-74769 Dell CVE debrief

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass. The CVE record was published on 2026-09-03T13:06:07.447Z and has not been modified since then. This vulnerability affects the REST API and can be mitigated by reviewing and applying vendor security updates, restricting access to the REST API, and monitoring for suspicious activity. IT administrators and security teams should review and apply security updates to mitigate potential authorization bypass risks. They should also verify system configurations, review and apply security updates, and monitor for suspicious activity. Additionally, security teams should perform vulnerability assessments and penetration testing to identify potential vulnerabilities.

Vendor: Dell
Product: PowerProtect Data Manager
CVSS: MEDIUM 6.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-09-03
Original CVE updated: 2026-09-05
Advisory published: 2026-09-03
Advisory updated: 2026-09-05

Who should care

IT administrators and security teams responsible for Dell PowerProtect Data Manager installations should review and apply security updates to mitigate potential authorization bypass risks. They should also verify system configurations, review and apply security updates, and monitor for suspicious activity. Additionally, security teams should perform vulnerability assessments and penetration testing to identify potential vulnerabilities.

Technical summary

CVE-2026-74769 is an Incorrect Authorization vulnerability in Dell PowerProtect Data Manager, versions 20.2.0.0 and below, affecting the REST API. A low-privileged remote attacker could potentially exploit this vulnerability, leading to protection mechanism bypass. The vulnerability can be mitigated by reviewing and applying vendor security updates, restricting access to the REST API, and monitoring for suspicious activity.

Defensive priority

Medium-priority defensive review recommended due to potential authorization bypass.

Recommended defensive actions

Review and apply vendor security updates for Dell PowerProtect Data Manager
Restrict access to the REST API
Monitor for suspicious activity
Verify system configurations and inventory
Perform vulnerability assessment and penetration testing

Evidence notes

Evidence from official CVE and NVD sources indicates an Incorrect Authorization vulnerability in Dell PowerProtect Data Manager. Limited details available; further review of vendor advisories recommended. The vulnerability affects versions 20.2.0.0 and below, and a low-privileged remote attacker could potentially exploit this vulnerability, leading to protection mechanism bypass. Defenders should verify system configurations, review and apply security updates, and monitor for suspicious activity.

Sources and references

Verified primary and authoritative sources

CVE-2026-74769 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-74769

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-74769 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-74769

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://www.dell.com/support/kbdoc/en-us/000501452/dsa-2026-368-security-update-for-dell-powerprotect-data-manager-multiple-vulnerabilities

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.