Dell RecoverPoint for VMs Hit by Hardcoded Credential Flaw

A critical vulnerability in Dell RecoverPoint for Virtual Machines has been disclosed as CVE-2026-22769, affecting versions prior to 6.0.3.1 HF1. In our CVE report for CVE-2026-22769, you’ll find full technical details, CVSS scoring, attack-flow mappings (CWE → CAPEC → ATT&CK), a built-in Q&A section, and access to our AI Assistant for environment-specific questions.

The issue is classified as CWE-798 (Use of Hard-coded Credentials). RecoverPoint for VMs contains an embedded administrator credential for the Apache Tomcat Manager component. Because this credential is hardcoded and cannot be changed, an attacker who knows it can authenticate remotely without prior access. From there, it becomes possible to deploy a malicious web application, execute commands, and gain root-level persistence on the appliance. With a CVSS score of 10.0, this is the highest severity rating possible.

Real-World Exploitation Since 2024

Threat intelligence reporting indicates that a China-linked cluster tracked as UNC6201 has exploited this vulnerability since mid-2024. Attackers authenticated to the Tomcat Manager endpoint, uploaded a web shell, and deployed backdoors such as BRICKSTORM and later GRIMBOLT. In some intrusions, temporary “Ghost NICs” were created to pivot into internal systems and SaaS environments before being removed to limit forensic visibility.

This was not a theoretical risk — it was active, real-world exploitation.

How the Exploit Works

If the hardcoded credential is known, an attacker can interact with the Tomcat Manager interface directly. A simplified example:

curl -u admin:HARDCODED_PASSWORD \
     "https://recoverpoint-appliance/manager/text/deploy?path=/shell&update=true" \
     --upload-file shell.war

If successful, the uploaded WAR file becomes accessible:

https://recoverpoint-appliance/shell/

From there, system commands can be executed as root, enabling persistence mechanisms such as cron jobs, backdoors, or modified services.

How to Quickly Check If You Are Affected

Start by verifying your installed version:

cat /etc/version

If you are running a version earlier than 6.0.3.1 HF1, your system is vulnerable. Next, confirm whether the Tomcat Manager service is listening:

ss -tulnp | grep 8080

Then check for unexpected deployments:

ls /usr/local/tomcat/webapps/

And review Tomcat logs for suspicious deployment activity:

grep "manager/text/deploy" /usr/local/tomcat/logs/*

If you patched late, treat the system as potentially exposed and consider a deeper investigation.

Mitigation

Dell advises upgrading to version 6.0.3.1 HF1 or following the appropriate migration path for older 5.x releases. RecoverPoint appliances should only operate inside segmented, trusted networks and should never be exposed directly to the public internet. After patching, review logs and rotate credentials in adjacent systems as a precaution.

How BaseFortify Helps

BaseFortify automatically matches your installed components against official CPE data and links them to relevant CVEs like CVE-2026-22769. You immediately see whether your versions are affected, how severe the issue is, how it maps to known weakness classes and attack techniques, and what practical mitigation steps apply.

Instead of manually tracking vendor advisories, you gain immediate visibility into your real exposure. You can register for a free account at basefortify.eu and test it in your own environment.

Resources

CVE-2026-22769 is a reminder that hardcoded credentials remain one of the most dangerous weaknesses in infrastructure software. If you operate Dell RecoverPoint for Virtual Machines, verify your version immediately and ensure no unauthorized access occurred before patching.

Dell RecoverPoint for VMs Hit by Hardcoded Credential Flaw - CVE-2026-22769