CVE-2026-22267
Published: 19 February 2026
Summary
CVE-2026-22267 is a high-severity Incorrect Privilege Assignment (CWE-266) vulnerability in Dell Powerprotect Data Manager. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 32.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-22267 is an Incorrect Privilege Assignment vulnerability (CWE-266) in Dell PowerProtect Data Manager versions prior to 19.22. Published on 2026-02-19T10:16:11.800, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, and low privileges required for exploitation.
A low-privileged attacker with remote access can exploit this vulnerability to achieve elevation of privileges. Successful exploitation allows the attacker to perform unauthorized actions, resulting in high impacts to integrity and availability, though confidentiality remains unaffected.
Dell's security advisory DSA-2026-046 addresses this and other vulnerabilities in PowerProtect Data Manager. Practitioners should refer to the advisory at https://www.dell.com/support/kbdoc/en-us/000429778/dsa-2026-046-security-update-for-dell-powerprotect-data-manager-multiple-vulnerabilities for details on patches and mitigation recommendations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7735
Vulnerability details
Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct privilege escalation from low-privileged remote access due to incorrect privilege assignment.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the specific incorrect privilege assignment flaw in Dell PowerProtect Data Manager versions prior to 19.22, preventing exploitation.
Enforces the principle of least privilege to restrict low-privileged remote attackers from escalating privileges due to incorrect assignment.
Mandates enforcement of approved access authorizations, blocking unauthorized actions from privilege escalation exploits.