CVE-2026-22769

Name of the Vulnerable Software and Affected Versions Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1

Description Dell RecoverPoint for Virtual Machines contains a critical flaw involving hardcoded Apache Tomcat Manager admin credentials. An unauthenticated remote attacker with knowledge of these credentials can gain unauthorized access to the underlying operating system, achieve root-level persistence, and execute remote code. This issue has been actively exploited in the wild since mid-2024 by the threat actor UNC6201 (linked to Silk Typhoon).

Technical exploitation involves uploading malicious WAR files to deploy the SLAYSTYLE web shell, which serves as initial access. Attackers have used this to deploy backdoors such as BRICKSTORM and a newer C# AOT-compiled and UPX-packed variant called GRIMBOLT. To maintain persistence, attackers modify startup scripts including rc.local and /home/kos/kbox/.../convert hosts.sh.

Furthermore, the attackers employ advanced lateral movement techniques within VMware ESXi environments, such as creating Ghost NICs (temporary virtual network interfaces) to pivot stealthily and using iptables for Single Packet Authorization (SPA) proxying to redirect traffic on port 443 to port 10443.

Recommendations Upgrade to version 6.0.3.1 HF1. As a temporary mitigation, run Dell's provided security scripts and restrict the software's access within internal networks. Monitor logs at /home/kos/auditlog/fapi cl audit log.log for suspicious Tomcat Manager access and unauthorized WAR file deployments.