TL;DR
['Dell RecoverPoint for VMs suffers from a critical zero-day exploit (CVE-2026-22769) since mid-2024, likely due to hard-coded credentials.', 'Exploitation details are revealed by Google Mandiant and GTIG in a new report.']
What happened
['A high-severity vulnerability in Dell RecoverPoint for VMs was exploited as a zero-day starting from mid-2024 by UNC6201 threat cluster, according to reports.', 'The flaw allows attackers to use hard-coded credentials to gain unauthorized access to systems.']
Why it matters for ops
['This incident highlights the importance of continuous security monitoring and prompt patching for enterprise solutions like Dell RecoverPoint for VMs.', 'Operators need to assess their exposure and take necessary steps to mitigate risks associated with zero-day vulnerabilities.']
Mitigation
- Apply Dell-provided patches as soon as they become available.
- Review and update access controls to ensure that hard-coded credentials are not used.
Action items
- Immediately review system configurations for any use of default or hardcoded credentials.
- Implement additional monitoring on virtual machine environments and log activity related to the affected software.
Detection IOCs
- Hard-coded credential usage patterns
- Abnormal activity in virtual machine backups and replication processes
Source link
https://thehackernews.com/2026/02/dell-recoverpoint-for-vms-zero-day-cve.html