CVE-2026-22266
Dell Powerprotect Data Manager ≤ 19.22
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:LSummary
CVE-2026-22266 is a medium-severity Improper Neutralization of Expression/Command Delimiters (CWE-146) vulnerability in Dell Powerprotect Data Manager. Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 20th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-22266 is an Improper Verification of Source of a Communication Channel vulnerability (CWE-146) affecting the REST API in Dell PowerProtect Data Manager versions prior to 19.22. This flaw allows inadequate validation of communication channel origins, potentially enabling unauthorized actions within the application's security boundaries. The vulnerability received a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L), classifying it as medium severity due to its network accessibility and low complexity, though requiring high privileges.
A high-privileged attacker with remote access can exploit this vulnerability to bypass protection mechanisms. Exploitation does not require user interaction and maintains an unchanged impact scope, potentially resulting in low-level impacts to confidentiality, integrity, and availability, such as limited unauthorized data access, modification, or disruption within the affected component.
Dell's security advisory DSA-2026-046, available at https://www.dell.com/support/kbdoc/en-us/000429778/dsa-2026-046-security-update-for-dell-powerprotect-data-manager-multiple-vulnerabilities, addresses this and other vulnerabilities in PowerProtect Data Manager with a security update to version 19.22 or later. Security practitioners should review the advisory for patching instructions and apply updates promptly to mitigate risks.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8337
Vulnerability Data
Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly stops unneutralized expression/command delimiters from reaching downstream components.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization to prevent delimiter/command injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect the weakness but does not prevent it by itself.
Secure development life cycle mandates input validation and output encoding that directly neutralizes expression/command delimiters.
Application security requirements explicitly call for controls against injection and delimiter-based attacks.
Secure architecture principles reduce attack surface but do not prescribe delimiter neutralization.
Secure coding standards require proper neutralization of special elements, directly eliminating this weakness.