CVE-2026-28264: Dell PowerProtect Information Disclosure

CVE-2026-28264 Overview

Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.

Critical Impact

Low privileged local attackers can exploit improper file permissions to access sensitive information protected by the Dell PowerProtect Agent Service.

Affected Products

• Dell PowerProtect Agent Service versions prior to 20.1
• Dell PowerProtect Data Manager (associated product)

Discovery Timeline

• April 8, 2026 - CVE-2026-28264 published to NVD
• April 8, 2026 - Last updated in NVD database

Technical Details for CVE-2026-28264

Vulnerability Analysis

This vulnerability is classified as CWE-732 (Incorrect Permission Assignment for Critical Resource), which occurs when software sets permissions for a critical resource in a way that allows unintended actors to read, modify, or delete the resource. In the context of Dell PowerProtect Agent Service, the vulnerability allows local users with low privileges to access information that should be restricted to authorized administrators or system processes.

The attack requires local access to the affected system, meaning an attacker must already have some level of system access before exploitation is possible. However, once this prerequisite is met, the exploitation complexity is low and requires no user interaction, making it relatively straightforward for an authenticated local user to leverage.

Root Cause

The root cause stems from incorrect permission assignment for critical resources within the Dell PowerProtect Agent Service. Files, directories, or other system resources used by the service are configured with overly permissive access controls, allowing users with limited privileges to read sensitive information. This type of misconfiguration typically occurs when installation routines or service configurations fail to properly restrict access to configuration files, log files, or data stores that may contain sensitive information.

Attack Vector

The attack vector is local, requiring the attacker to have authenticated access to the affected system. A low-privileged user can exploit the misconfigured permissions to access sensitive information that should be protected. This could include configuration data, credentials, backup metadata, or other sensitive information managed by the PowerProtect Agent Service. The vulnerability does not allow for privilege escalation or system modification, but the information exposed could facilitate further attacks.

The exploitation mechanism involves a local attacker identifying and accessing resources with improper permissions set by the Dell PowerProtect Agent Service. Due to the nature of this vulnerability (permission misconfiguration), no code-based exploit is required—standard file system access commands or tools can be used to read the exposed information. Refer to the Dell Security Update DSA-2026-158 for specific technical details.

Detection Methods for CVE-2026-28264

Indicators of Compromise

• Unusual file access patterns to Dell PowerProtect Agent Service directories by non-administrative users
• Audit logs showing low-privileged users accessing protected configuration files or data stores
• Evidence of enumeration activities targeting PowerProtect service file locations

Detection Strategies

• Enable and monitor Windows Security Event logs for file access events (Event ID 4663) on PowerProtect Agent Service directories
• Implement file integrity monitoring (FIM) on sensitive PowerProtect configuration and data directories
• Review access control lists (ACLs) on PowerProtect Agent Service resources to identify misconfigured permissions

Monitoring Recommendations

• Configure security monitoring solutions to alert on access to PowerProtect Agent Service resources by non-service accounts
• Establish baseline access patterns for legitimate administrative activities and alert on deviations
• Regularly audit file system permissions on systems running Dell PowerProtect Agent Service

How to Mitigate CVE-2026-28264

Immediate Actions Required

• Upgrade Dell PowerProtect Agent Service to version 20.1 or later immediately
• Audit current file permissions on PowerProtect Agent Service resources pending upgrade
• Review recent access logs for signs of exploitation prior to patching
• Restrict local system access to only authorized personnel

Patch Information

Dell has released a security update addressing this vulnerability. Organizations should upgrade Dell PowerProtect Agent Service to version 20.1 or later. Full details and download information are available in the Dell Security Update DSA-2026-158.

Workarounds

• Manually review and restrict permissions on Dell PowerProtect Agent Service directories and files to limit access to administrative accounts only
• Implement additional access controls at the operating system level to restrict local user access to sensitive directories
• Enable comprehensive auditing on PowerProtect resources to detect and investigate any unauthorized access attempts
• Consider network segmentation to limit which systems can access servers running the vulnerable service

# Example: Audit current permissions on PowerProtect directories (Windows)
# Run in elevated PowerShell
icacls "C:\Program Files\Dell\PowerProtect Agent" /T

# Review and restrict permissions as needed
icacls "C:\Program Files\Dell\PowerProtect Agent" /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" /grant:r "Administrators:(OI)(CI)F"