Path traversal in Dell Avamar Server
Priority LOW 29CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Dell Avamar Server and Avamar Virtual Edition, versions prior to 19.10 SP1 with CHF338912, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the Security. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary file delete.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00378 31st percentileScored 2026-11-07
Fix Fixed Avamar Server (Dell): 19.10 SP1 with CHF 338912 or laterAvamar Virtual Edition (Dell): 19.10 SP1 with CHF 338912 or later+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Avamar Server | 19.9 through 19.10 SP1 to before 19.10 SP1 with CHF 338912 or later | 19.10 SP1 with CHF 338912 or later | Patch available | CNA |
| Dell | Avamar Virtual Edition | 19.9 through 19.10 SP1 to before 19.10 SP1 with CHF 338912 or later | 19.10 SP1 with CHF 338912 or later | Patch available | CNA |
| Dell | PowerProtect DP Series Appliance (IDPA) | N/A to before 2.7.9 with AV CHF 338912 | 2.7.9 with AV CHF 338912 | Patch available | CNA |
- Avamar Server VendorDell Affected 19.9 through 19.10 SP1 to before 19.10 SP1 with CHF 338912 or later Fixed in 19.10 SP1 with CHF 338912 or later Patch available CNA
- Avamar Virtual Edition VendorDell Affected 19.9 through 19.10 SP1 to before 19.10 SP1 with CHF 338912 or later Fixed in 19.10 SP1 with CHF 338912 or later Patch available CNA
- PowerProtect DP Series Appliance (IDPA) VendorDell Affected N/A to before 2.7.9 with AV CHF 338912 Fixed in 2.7.9 with AV CHF 338912 Patch available CNA
Remediation
- Fix · CNA Avamar Server (Dell) Fixed in 19.10 SP1 with CHF 338912 or later
- Fix · CNA Avamar Virtual Edition (Dell) Fixed in 19.10 SP1 with CHF 338912 or later
- Fix · CNA PowerProtect DP Series Appliance (IDPA) (Dell) Fixed in 2.7.9 with AV CHF 338912
Timeline
- 2026-10-02 Threatist record created from CVE-2026-22762
- 2026-10-03 Alias added: GHSA-cc8m-46cg-cg54
More Dell vulnerabilities
- TI-2026-18287 Hard-coded credentials in Dell RecoverPoint for Virtual Machines KEVCVSS 3.1CRITICAL 10.0
- TI-2021-04636 Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which… KEVCVSS 3.1HIGH 8.8
- TI-2025-24909 OS command injection in Dell Unity CVSS 3.1CRITICAL 9.8
- TI-2018-01121 Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability… CVSS 3.0CRITICAL 9.8
- TI-2020-09565 The Treck TCP/IP stack before 6.0.1.66 has an IPv6 Out-of-bounds Read. KEVCVSS 3.1MEDIUM 5.4
- TI-2022-08298 Improper authentication in Dell Integrated Dell Remote Access Controller 9 CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-22762 · CVE Program
- CVE-2026-22762 · NVD
- FIRST EPSS
- GHSA-cc8m-46cg-cg54 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences