External risk intelligence

Dell PowerProtect Data Manager REST API Privilege Escalation Vulnerability

CVE advisorySeverity: HIGH (CVSS 7.2)

CVE-2026-40712

The vulnerability exists in the REST API of a data management appliance. While REST APIs can be internet-facing, enterprise data protection products of this type are typically deployed within internal management networks, and the requirement for high privileges further limits the likelihood of common public internet exposure.

Dell Powerprotect Data Manager

before 20.2

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability found in Dell PowerProtect Data Manager's REST API, which could allow a highly privileged attacker to gain elevated access. The main concern is to confirm relevance and exposure within your environment.

Improper input validation allows privilege escalation.
High-privilege API access is a significant risk.
Confirm if this critical vulnerability affects our systems.

Attack Path

How an attacker could exploit the issue

An attacker with high privileges and remote access could target the Dell PowerProtect Data Manager's REST API. By sending specially crafted input to the API, the attacker could exploit an improper input validation flaw. This could allow them to elevate their privileges within the system.

Requires high privileges and remote access.
Triggered by improper input to the REST API.
Allows privilege escalation within the system.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Dell PowerProtect Data Manager's REST API could allow a highly privileged attacker with remote access to elevate their privileges. This means that if an attacker gains sufficient existing access and can reach the API over the network, they might be able to gain even greater control over the system. The advisory does not specify what types of system or user data could be affected beyond the potential for privilege escalation.

System access and control.
Remote exploitation via network.
Privilege escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Dell PowerProtect Data Manager's REST API likely falls under the responsibility of the infrastructure or platform team managing the data protection environment. The first step is to identify all instances of the affected software, confirm their accessibility and business criticality, and then assign an owner for remediation planning.

Identify affected Dell PowerProtect instances.
Verify network exposure and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dell PowerProtect Data Manager?

It is an enterprise software solution designed for data protection, backup, and recovery across complex IT environments. Organizations rely on this platform to manage and secure their critical data assets, ensuring availability and compliance. The software includes a REST API that administrators use to automate management tasks and integrate the appliance with other enterprise systems.

What does improper input validation mean for CVE-2026-40712?

This vulnerability, classified as CWE-20, means the API fails to properly inspect or sanitize the data it receives from users. Because the system trusts this input without adequate verification, a malicious actor could send crafted data to trigger unintended operations. In this specific case, the flaw allows someone who already has high-level access to manipulate the system and escalate their privileges further.

How is this vulnerability triggered?

An attacker must have remote network access to the Dell PowerProtect Data Manager REST API and possess high-level credentials to initiate the exploit. Simply sending random or malformed data without these specific, elevated authorization levels will not trigger the privilege escalation. The flaw requires the attacker to interact with the API interface using their existing, albeit lower, administrative rights.

Do I need to worry if my system is internal?

Halo Surface Signal indicates that while the vulnerability is remotely exploitable, Dell PowerProtect Data Manager is typically deployed within protected, internal management networks. If your instance is not exposed to the public internet, the practical risk is lower, though it remains a concern if an attacker has already breached your internal network perimeter.

When should I take action for this vulnerability?

You should begin by identifying all instances of Dell PowerProtect Data Manager running versions prior to 20.2.0.0. Once localized, confirm the network accessibility and business criticality of each instance. Coordinate with the teams responsible for your data protection infrastructure to prioritize these systems for security updates and remediation planning as soon as possible.

References

www.dell.com/support/kbdoc/en-us/000488847/dsa-2026-287-security-u…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.