Quick answers
- Is CVE-2026-74769 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-74769 being exploited in the wild.
- How severe is CVE-2026-74769?
- Medium severity, with a CVSS score of 6.5, published 3 September 2026.
- Which products and versions are affected?
- Dell Powerprotect Data Manager 20.2.0.0 and below.
- Is there a fix for CVE-2026-74769?
- A patch was published on 2026-08-26: Patch available in version 20.3.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-74769 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-74769?
- Check whether you run Dell Powerprotect Data Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2026-74769 is an incorrect authorization vulnerability in the REST API of Dell PowerProtect Data Manager version 20.2.0.0 and below. A low-privileged authenticated remote attacker can bypass authorization checks on API endpoints, achieving privilege escalation or unauthorized modification of protected resources. The attack requires network access to the API and valid login credentials, but no administrator privileges. This results in a protection mechanism bypass, allowing attackers to manipulate backup policies or access policies. Dell released version 20.3.0.0 as the patched version.
Affected products
- Dell PowerProtect Data Manager 20.2.0.0 and below
Timeline
- 2026-09-03: disclosed: NVD publication
- 2026-08-24: advisory: Dell DSA-2026-368 initial release
- 2026-08-26: patched: Patch available in version 20.3.0.0