CVE-2025-26335 Overview
Dell PowerProtect Cyber Recovery contains an information disclosure vulnerability in versions prior to 19.18.0.2. The flaw is classified as Insertion of Sensitive Information Into Sent Data [CWE-201]. A remote attacker with high privileges can exploit the weakness to obtain sensitive information transmitted by the product. Dell published the fix in security advisory DSA-2025-113.
Critical Impact
Authenticated remote attackers with high privileges can retrieve sensitive information from Dell PowerProtect Cyber Recovery, undermining the confidentiality of a system designed to protect backup and recovery data.
Affected Products
- Dell PowerProtect Cyber Recovery versions prior to 19.18.0.2
Discovery Timeline
- 2025-04-11 - CVE-2025-26335 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-26335
Vulnerability Analysis
Dell PowerProtect Cyber Recovery is an isolated recovery vault that stores immutable copies of production data for ransomware recovery. The product transmits data between management components and downstream systems as part of its normal operation. In versions prior to 19.18.0.2, the application inserts sensitive information into data it sends outside its trust boundary. An authenticated actor with high privileges and network reachability to the affected component can observe that data and recover the exposed information.
The issue affects confidentiality only. Integrity and availability of the recovery vault are not impacted by this specific weakness. However, exposure of credentials, tokens, or configuration secrets from a recovery platform can enable follow-on attacks against the backup infrastructure it protects.
Root Cause
The root cause maps to [CWE-201]: Insertion of Sensitive Information Into Sent Data. The application includes information in outbound data flows that should have been filtered, masked, or omitted. Consumers of that data receive fields the sender did not intend to expose. Dell has not published the specific field, protocol, or interface affected in the public advisory.
Attack Vector
The attack vector is network based with low complexity. Exploitation requires an authenticated account with high privileges on the PowerProtect Cyber Recovery instance and no user interaction. An attacker in that position captures or reads legitimately transmitted data and extracts the sensitive content included by the vulnerable code path. Consult the Dell Security Update DSA-2025-113 for vendor-supplied technical details.
Detection Methods for CVE-2025-26335
Indicators of Compromise
- No public indicators of compromise have been published for CVE-2025-26335.
- Review PowerProtect Cyber Recovery audit and application logs for unexpected access by high-privileged accounts prior to patching.
Detection Strategies
- Inventory all Dell PowerProtect Cyber Recovery deployments and confirm the running build against 19.18.0.2 or later.
- Alert on administrative sessions from unusual source addresses or outside change windows for the Cyber Recovery management interface.
- Correlate authentication events with data-export, report-generation, and API calls that could return sensitive fields.
Monitoring Recommendations
- Forward PowerProtect Cyber Recovery audit logs to a centralized log platform and retain them for the organization's incident response window.
- Monitor privileged account usage on the recovery vault and require step-up authentication for administrative actions.
- Track network flows between the Cyber Recovery host and any downstream data recipients to detect unexpected destinations.
How to Mitigate CVE-2025-26335
Immediate Actions Required
- Upgrade Dell PowerProtect Cyber Recovery to version 19.18.0.2 or later as specified in DSA-2025-113.
- Rotate credentials, API keys, and secrets that may have been transmitted by vulnerable versions.
- Review the roster of accounts with high privileges on the Cyber Recovery platform and remove unnecessary access.
Patch Information
Dell addressed CVE-2025-26335 in Dell PowerProtect Cyber Recovery 19.18.0.2. Patch details and download links are available in the Dell Security Update DSA-2025-113.
Workarounds
- Dell has not published a supported workaround; apply the vendor patch to remediate the vulnerability.
- Restrict network access to the PowerProtect Cyber Recovery management plane to a defined administrative subnet until the upgrade completes.
- Enforce multi-factor authentication for all administrative accounts on the recovery vault to reduce the risk of privileged account misuse.
# Verify installed Dell PowerProtect Cyber Recovery version
crsetup.sh --version
# Expected output should be 19.18.0.2 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
