CVE-2026-79939 is a medium severity (CVSS 5.8) UNIX symbolic link following flaw in Dell PowerProtect Cyber Recovery versions before 20.3. A low privileged attacker with local access could achieve script injection. Upgrade to 20.3 or later, and confirm details in Dell advisory DSA-2026-370.
What's affected
- Dell PowerProtect Cyber Recovery versions prior to 20.3, per the CVE record.
- Fixed in 20.3 or later, as implied by the record. We could not retrieve the Dell advisory page when preparing this post, so the versions here come from the CVE record. Confirm them against the Dell advisory before you act.
- The record says the attacker needs local access and low privileges.
Record severity: CVSS 5.8 (medium), vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L. The weakness class is CWE-61, UNIX Symbolic Link (Symlink) Following.
How to check if you're exposed
Read the product version in the management interface and compare with 20.3. Then list who has local or shell access to the Cyber Recovery host, because the issue needs local access to the system.
What to do now
- Confirm the version on each Cyber Recovery host.
- Upgrade to 20.3 or later following Dell instructions.
- Reduce the number of local accounts on the host to those with a clear need.
- Review file system permissions on directories used by the product if Dell guidance mentions them.
- Record the upgrade date for audit.
Why it matters
Symbolic link following (CWE-61) happens when a program opens a path without noticing that it is a link to somewhere else. A local user who can create links in a place the program trusts can steer the program at a different file. The record names script injection as the result.
Because local access is needed, this is mostly a concern on hosts where several people hold shell accounts, or after another compromise. The record does not mark the CVE as exploited in the wild.
Quick check
Can this be exploited remotely?
The record says the attacker needs local access.
What is the fix?
Upgrade to 20.3 or later; check Dell for exact steps.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
