CVE-2026-79938 is a high severity (CVSS 7.6) improper authentication flaw in Dell PowerProtect Cyber Recovery versions before 20.3. A low privileged attacker with remote access could gain unauthorized access. The record points to version 20.3 as the release that addresses it. Confirm in Dell advisory DSA-2026-370.
What's affected
- Dell PowerProtect Cyber Recovery versions prior to 20.3, per the CVE record.
- Fixed in 20.3 or later, as the record version boundary implies. We could not retrieve the Dell advisory page when preparing this post, so the versions here come from the CVE record. Confirm them against the Dell advisory before you act.
- The record says a low privileged attacker with remote access could exploit it.
Record severity: CVSS 7.6 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L. The weakness class is CWE-287, Improper Authentication.
How to check if you're exposed
Sign in to the Cyber Recovery management interface and read the product version. If it is below 20.3, it is in range. Then review which accounts exist on the system, especially low privileged ones, and which networks can reach the management interface.
What to do now
- Read the installed version of each Cyber Recovery system.
- Plan an upgrade to 20.3 or later using Dell instructions in DSA-2026-370.
- Review and remove unused accounts, and confirm strong credentials on the rest.
- Keep the management interface on an isolated network, since the product is meant to protect data from attackers.
- Review access logs for sign ins you cannot explain.
Why it matters
Improper authentication (CWE-287) means the system accepts an identity claim it should have checked more carefully. Cyber Recovery is a vault style product, so unauthorized access to it matters more than the score alone suggests. Backup and recovery systems hold copies of everything and are a priority target.
The record does not mark this CVE as known exploited, and the Dell page was not retrievable by us, so check DSA-2026-370 for any notes on exploitation or mitigations. The same advisory also covers third party component issues in the product.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
The record says versions prior to 20.3 are affected, so 20.3 or later. Confirm with Dell.
Is it exploited in the wild?
The record does not flag it as known exploited, and Dell text was not available to us.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
