CVE-2026-22769

What it actually does

The vulnerability is a hardcoded credential flaw that can allow an unauthenticated remote attacker who knows the embedded credential to authenticate to the affected appliance or service without valid customer-issued credentials. Successful exploitation can provide access to the underlying operating system with root-level privileges, enabling full confidentiality, integrity, and availability compromise, including installation of persistence mechanisms, modification of system files, credential theft, and disruption of replication or recovery services. The provided metadata identifies Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1 as affected; the supplied package metadata also lists Vaadin Maven packages with fixed versions, which should be validated against vendor advisories before remediation planning.

Why it matters to the business

Because exploitation can result in unauthenticated remote root access, this issue can lead to full takeover of recovery infrastructure, interruption of disaster recovery capabilities, manipulation or destruction of replicated data, theft of sensitive operational data, and extended outage during incident response. The vulnerability is listed in CISA KEV, has active in-the-wild exploitation, a critical CVSS score, and a CISA remediation due date of 2026-02-21, so exposed systems should be treated as urgent even though the EPSS score is moderate. Compromise of recovery platforms is especially high impact because attackers may use them to weaken restoration options before ransomware, destructive activity, or extortion, even though this entry is not currently flagged as ransomware-used.

How an attack unfolds

An attacker first identifies an internet-accessible or reachable management interface, appliance service, or administrative protocol associated with the affected product. Because the credential is embedded in the product rather than created uniquely by each organization, the attacker can attempt authentication using the known hardcoded credential without prior access, phishing, or user interaction. If authentication succeeds, the attacker gains unauthorized access to the underlying operating system, potentially with root-level privileges. From there, the attacker can enumerate the environment, dump local credentials or keys, modify system configuration, create new users or SSH keys, install web shells or remote access tools, tamper with logs, and establish persistence. In campaigns associated with BRICKSTORM or similar activity, defenders should assume the initial appliance compromise may be used as a foothold for stealthy persistence and lateral movement rather than only opportunistic access.

How to fix it

Upgrade Dell RecoverPoint for Virtual Machines to version 6.0.3.1 HF1 or later, or apply Dell-provided remediations and mitigations immediately. If immediate upgrade is not possible, restrict access to management and administrative interfaces to trusted management networks, block direct internet exposure, enforce network allowlisting, disable unnecessary services, rotate all credentials that may have been exposed through the appliance, and monitor for unauthorized root or administrative access. Because the supplied metadata also lists Maven packages, validate whether those packages are in scope for this advisory; if they are present in application inventories, update com.vaadin:vaadin to 23.6.6, 24.8.14, or 24.9.7 as appropriate for the deployed branch, com.vaadin:vaadin-server to 7.7.50 or 8.30.0 as appropriate, and com.vaadin:vaadin-spreadsheet-flow to 23.6.6, 24.8.14, or 24.9.7 as appropriate. Treat the vendor appliance upgrade as the priority when the deployed product is Dell RecoverPoint for Virtual Machines.

How to confirm the fix worked

Confirm the deployed product version from the appliance console, management UI, package inventory, or vendor-supported command output and verify it is 6.0.3.1 HF1 or later for Dell RecoverPoint for Virtual Machines. Validate that administrative interfaces are not reachable from untrusted networks and that firewall rules restrict access to approved management sources only. Review software composition analysis, Maven dependency output, or build manifests for the listed Vaadin packages and confirm any applicable package versions meet or exceed the fixed versions provided. After patching, attempt only authorized validation through vendor-supported checks or controlled authentication testing to confirm the hardcoded credential is no longer accepted. Also verify that no unauthorized users, SSH keys, startup jobs, cron entries, modified system binaries, or unexpected remote access services remain after remediation.

Typical attack path

1. Discover exposed RecoverPoint for Virtual Machines management interfaces, appliance services, or reachable administrative ports.
2. Attempt authentication using the known hardcoded credential against the vulnerable service or operating system interface.
3. Obtain unauthorized shell, administrative, or root-level access to the appliance operating system.
4. Enumerate local users, configuration files, network routes, mounted storage, replication settings, and stored credentials or keys.
5. Create persistence such as new local accounts, SSH authorized keys, modified startup scripts, scheduled tasks, or additional remote access tooling.
6. Use the appliance position to pivot, collect sensitive operational data, interfere with recovery operations, or prepare for broader intrusion activity.
7. Cover tracks by deleting or altering logs, rotating timestamps, disabling monitoring agents, or blending into legitimate administrative activity.

How to detect it

Review authentication, system, appliance, SSH, sudo, audit, web management, EDR, firewall, VPN, and network flow logs for evidence of unauthorized access to affected RecoverPoint for Virtual Machines systems. Focus on successful logins from unfamiliar source IPs, especially root or administrative sessions, logins outside normal maintenance windows, repeated authentication attempts followed by success, unexpected service restarts, new local users, new SSH authorized keys, modified sudoers files, unusual outbound connections, and log deletion or truncation. On Linux-based appliances, inspect /var/log/auth.log, /var/log/secure, /var/log/messages, shell history files, cron directories, systemd unit directories, /root/.ssh/authorized_keys, /etc/passwd, /etc/shadow metadata, and recently modified files under /etc, /tmp, /var/tmp, and appliance application directories. In network telemetry, look for administrative protocol access to appliance management addresses from non-management networks and outbound connections from the appliance to rare external destinations. If BRICKSTORM-related activity is a concern, hunt for stealthy persistence and long-duration command-and-control behavior rather than only obvious malware execution. Absence of a known public credential in logs does not rule out exploitation, because successful use of a hardcoded credential may appear as a normal login unless correlated with source, timing, and post-authentication behavior.

• Accepted password for root
• session opened for user root
• Failed password for root
• authentication failure
• /root/.ssh/authorized_keys
• /etc/ssh/sshd_config
• /etc/sudoers
• /etc/passwd
• /etc/shadow
• /var/log/auth.log
• /var/log/secure
• /var/log/messages
• /var/log/audit/audit.log
• /var/spool/cron/root
• /etc/crontab
• /etc/cron.d/
• /etc/systemd/system/
• /tmp/
• /var/tmp/
• RecoverPoint
• RecoverPoint for Virtual Machines
• RP4VM
• BRICKSTORM

What your security team should do

• Immediately identify all deployments of Dell RecoverPoint for Virtual Machines and prioritize any versions prior to 6.0.3.1 HF1 for emergency remediation.
• Meet or beat the CISA KEV remediation deadline of 2026-02-21; because exploitation is active in the wild, do not wait for routine patch cycles.
• Remove direct internet exposure and restrict all appliance management access to tightly controlled administrative networks.
• Assume vulnerable, exposed systems may already be compromised; perform threat hunting and forensic review before and after patching.
• Search for signs of BRICKSTORM-style persistence, including unusual appliance logins, new SSH keys, altered startup files, suspicious long-running processes, and unexplained outbound connections.
• Rotate credentials, API tokens, SSH keys, and integration secrets that were stored on or accessible from affected appliances.
• Validate the apparent metadata mismatch between Dell RecoverPoint for Virtual Machines and the listed Vaadin Maven packages with authoritative vendor advisories and update dependency inventories where applicable.
• Increase monitoring on recovery infrastructure, because compromise of backup or disaster recovery systems can materially reduce restoration capability during a larger incident.