Read the docs
TI-2025-19300 Aliases CVE-2025-26335GHSA-hg7r-chw9-hcv4

Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of…

Priority LOW 26CWE-201Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-201.

Summary

Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive Information Into Sent Data vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00339 27th percentileScored 2026-11-07
Fix Fixed PowerProtect Cyber Recovery (Dell): 19.18.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellPowerProtect Cyber RecoveryN/A to before 19.18.0.219.18.0.2Patch availableCNA
  • PowerProtect Cyber Recovery VendorDell Affected N/A to before 19.18.0.2 Fixed in 19.18.0.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dell:powerprotect_cyber_recovery:*:*:*:*:*:*:*:*before 19.18.0.2VulnerableDell
  • cpe:2.3:a:dell:powerprotect_cyber_recovery:*:*:*:*:*:*:*:* Versions before 19.18.0.2 Vulnerable ·Dell

Remediation

  • Fix · CNA PowerProtect Cyber Recovery (Dell) Fixed in 19.18.0.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-26335
  2. 2026-10-03 Alias added: GHSA-hg7r-chw9-hcv4

References

Advisory 1

  • TI-2022-15271 Authentication bypass in Dell Cyber Recovery CVSS 3.1CRITICAL 9.8
  • TI-2023-15748 Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. CVSS 3.1HIGH 8.8
  • TI-2026-55292 Improper authentication in Dell Power Protect Cyber Recovery CVSS 3.1HIGH 8.8
  • TI-2022-14123 Dell PowerProtect Cyber Recovery, versions prior to 19.11, contain a privilege escalation… CVSS 3.1HIGH 7.8
  • TI-2026-55293 Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link… CVSS 3.1HIGH 7.8
  • TI-2026-36716 SQL injection in Dell Power Protect Cyber Recovery CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences