CVE-2026-49809
Received Received - Intake

SQL Injection in Dell PowerProtect Cyber Recovery

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: Dell

Description
Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-49809

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dell powerprotect_cyber_recovery to 20.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Dell PowerProtect Cyber Recovery versions 20.2 and prior have an SQL Injection vulnerability. This flaw allows a low-privileged attacker with remote access to inject malicious SQL commands, potentially leading to unauthorized information disclosure.

Detection Guidance

Detection of SQL injection vulnerabilities like CVE-2026-49809 typically involves monitoring network traffic for suspicious SQL queries, inspecting application logs for unusual database access patterns, and using web application firewalls to block malicious inputs. Specific commands depend on your environment but may include SQL query analysis tools, log scanners, or intrusion detection systems.

Impact Analysis

An attacker could exploit this to access sensitive data stored in the database, such as configuration details or user information. This may result in data breaches or unauthorized access to confidential information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing personal or health data. Organizations may face legal penalties, fines, or reputational damage due to unauthorized data access.

Mitigation Strategies

Update Dell PowerProtect Cyber Recovery to versions beyond 20.2 to address the SQL injection vulnerability. Ensure proper input validation and sanitization for all SQL queries. Restrict remote access to only trusted sources and implement network segmentation to limit exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49809. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart