Quick answers
- Is CVE-2026-74768 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-74768 being exploited in the wild.
- How severe is CVE-2026-74768?
- Medium severity, with a CVSS score of 4.1, published 3 September 2026.
- Which products and versions are affected?
- Dell Powerprotect Data Manager 20.2.0.0 and below.
- Is there a fix for CVE-2026-74768?
- A patch was published on 2026-08-24: Version 20.3.0.0 available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-74768 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-74768?
- Check whether you run Dell Powerprotect Data Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a Server-Side Request Forgery (SSRF) vulnerability in the Dell PowerProtect Data Manager REST API. The vulnerability requires high-level administrative privileges and network access to the API endpoint. An authenticated attacker can exploit this to make unauthorized HTTP requests from the server to internal or external systems, potentially bypassing network segmentation or accessing sensitive data. The attack vector is network-based with high privilege requirements. Dell has patched the vulnerability in version 20.3.0.0.
Affected products
- Dell PowerProtect Data Manager 20.2.0.0 and below
Timeline
- 2026-09-03: disclosed
- 2026-08-24: patched: Version 20.3.0.0 available