Security readout for executives and security teams
Plain-English summary
A flaw in Dell PowerProtect Data Manager’s REST API could let a remotely connected, highly privileged attacker gain additional privileges and seriously affect protected data or service availability. Systems running versions before 20.2.0.0 require prompt attention, particularly where the management API is broadly reachable.
Executive priority
Treat this as an urgent privileged-management-plane vulnerability. Prioritize externally or broadly reachable systems and environments protecting sensitive or business-critical backups. High privileges are required, but the potential impact is severe. Confirm inventory and access restrictions immediately, then expedite Dell’s update through change control.
Technical view
CVE-2026-40712 is a CWE-20 improper input validation issue in the PowerProtect Data Manager REST API. Exploitation requires remote network access and high privileges, with no user interaction. Dell reports potential privilege elevation. The CVSS scope change and high confidentiality, integrity, and availability impacts produce a 9.1 critical rating.
Likely exposure
Exposure is limited to Dell PowerProtect Data Manager versions before 20.2.0.0. Practical risk depends on REST API reachability and whether an attacker already possesses high privileges. The bundle does not identify affected configurations, ports, authentication paths, or internet exposure prevalence.
Exploitation context
The supplied record does not report active exploitation, and the CVE is not listed as KEV in the bundle. Exploitation requires high privileges, reducing initial-access likelihood, but successful abuse could cross a security boundary and cause broad confidentiality, integrity, and availability impact.
Researcher notes
The public bundle provides no root-cause detail, vulnerable endpoint, proof of concept, or confirmed exploitation. The structured affected entry contains an unclear version value of “0” and default status “unaffected,” while Dell’s description states versions before 20.2.0.0 are affected. Use the vendor advisory as the operational reference and verify revisions.
Mitigation direction
- Upgrade affected installations to version 20.2.0.0 or later, following Dell’s advisory.
- Restrict REST API access to trusted administrative networks and authorized operators.
- Review and minimize privileged accounts until remediation is complete.
- Monitor Dell guidance for additional mitigations or revised affected-version information.
Validation and detection
- Inventory PowerProtect Data Manager instances and record their exact installed versions.
- Confirm every instance before 20.2.0.0 is included in remediation tracking.
- Verify REST API exposure from untrusted networks and restrict unnecessary access.
- Review privileged-account and REST API activity for unexplained administrative changes.
- After upgrading, confirm the installed version and normal backup-management operations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-40712 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H2.36dellVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.dell.com/support/kbdoc/en-us/000488847/dsa-2026-287-security-update-dell-powerprotect-data-manager-for-multiple-security-vulnerabilitiesCVE reference, dell · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.