CVE-2026-74774 is an improper certificate validation flaw (CWE-295) in Dell PowerProtect One versions 20.1.0.0 and below. An unauthenticated remote attacker could bypass a protection mechanism. The record rates it Medium at 5.9. Read Dell advisory DSA-2026-369 for the fixed version.
What's affected
The record says Dell PowerProtect One versions 20.1.0.0 and below are affected. It gives no fixed version, and Dell's advisory page returned an access denied message when we fetched it, so we cannot name one. Open DSA-2026-369 and confirm the release that fixes the issue.
The vector uses network access with high attack complexity, no privileges and no user interaction. The impact is high for confidentiality and none for integrity and availability. The record's description lists protection mechanism bypass as the consequence.
How to check if you're exposed
Dell appliances and management software are checked through their own interfaces, not through a package manager. Open the administration console of the product and read the version on the About or System page, then compare it with the versions in the Dell advisory.
For a fleet, ask the team that owns the product for an inventory of versions, and record it somewhere central. If you track software in an inventory or SBOM, add the product and version so that the next advisory is a lookup.
What to do now
- Open Dell advisory DSA-2026-369 and note the fixed version.
- Plan the update of PowerProtect One to that version, following Dell's guidance.
- Review the network path between the product and the services it connects to, and keep it on trusted segments.
- Check whether any connection from the product is configured to skip certificate checks, and turn that off if so.
- Note the version in your inventory.
Why it matters
The weakness is improper certificate validation, CWE-295. Software that talks to another service over TLS should confirm that the certificate is valid and belongs to the expected host. If it does not, a person who can intercept the connection can impersonate the service and read what is sent. The record describes the result as a protection mechanism bypass, with the main impact on confidentiality.
Backup and data protection products hold copies of sensitive data and credentials for the systems they protect, so they are valued targets. Certificate flaws are slow to notice because everything still works. Verify the version, apply the vendor fix, and prefer private network paths for management traffic. KEV status is false.
Quick check
Is there a fixed version in the record?
No. Take the fixed version from Dell advisory DSA-2026-369.
Why is the score Medium?
The attack is hard to arrange, with high complexity, and the impact is limited to confidentiality.
Sources
Last reviewed: 18 October 2026.
