Overview

CVE-2026-22769 is a hardcoded credential vulnerability (CWE-798) in Dell RecoverPoint for Virtual Machines. It allows an unauthenticated remote attacker with knowledge of the embedded credentials to gain unauthorized access to the underlying operating system, achieving root-level persistence.

The flaw is present in the Apache Tomcat Manager configuration. It was actively exploited in the wild since at least mid-2024 by the threat cluster UNC6201 (suspected PRC-nexus). CVSS v3.1 score: 10.0 (Critical). Dell disclosed it on February 17, 2026, and it was added to the CISA KEV catalog.

Affected versions

  • Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1.
  • Also impacts certain 5.3 service packs and potentially earlier releases.

Remediations include upgrading to fixed versions or applying a remediation script/HF. Older EOL versions require specific steps.

Technical breakdown (root cause)

The vulnerability stems from hardcoded credentials (username/password pair) embedded in the Tomcat Manager configuration file (tomcat-users.xml). These credentials grant administrative access to the Tomcat Manager interface, allowing deployment of arbitrary WAR files and execution of commands as root on the appliance.

No additional authentication or complex chaining is required beyond knowledge of the static credentials. The issue enables direct unauthenticated access to the management interface over the network.

Attack chain (based on Mandiant / UNC6201 observations)

  1. Attacker uses knowledge of hardcoded Tomcat credentials to authenticate to the Manager interface.
  2. Deploys a malicious WAR file (e.g., containing the SLAYSTYLE webshell) via the /manager/text/deploy endpoint.
  3. Gains root-level command execution and persistence on the RecoverPoint appliance.
  4. Uses the compromised appliance for lateral movement into VMware environments, credential access, and deployment of additional malware (BRICKSTORM, GRIMBOLT backdoor).

Exploitation supported long-term persistence and espionage activities. GRIMBOLT is a C# backdoor with AOT compilation for evasion.

Detection guidance

  • Monitor access to Tomcat Manager endpoints (/manager/*) for unusual authentication or WAR deployment activity.
  • Look for web shell artifacts (e.g., SLAYSTYLE JSP) or unexpected processes on RecoverPoint appliances.
  • Detect outbound C2 traffic associated with BRICKSTORM/GRIMBOLT or anomalous admin logins.
  • Audit logs for Tomcat and system-level root activity.
  • YARA rules for known malware families deployed post-exploitation (available from Mandiant/GTIG).

Indicators of compromise (from Mandiant / Dell)

  • Hardcoded credential pairs used in Tomcat Manager (specific values in Dell advisory).
  • Malicious WAR files and JSP webshells (SLAYSTYLE).
  • Indicators of GRIMBOLT and BRICKSTORM malware (hashes, C2 patterns).
  • Suspicious deployments via /manager/text/deploy.

Consult Dell DSA-2026-079 and the Mandiant report for full lists.

Mitigation

  • Upgrade to RecoverPoint for Virtual Machines 6.0.3.1 HF1 or apply the official remediation script/HF.
  • For older versions (e.g., 5.3 SP4), follow Dell's specific guidance (upgrade path + remediation).
  • Restrict network access to RecoverPoint management interfaces (limit to trusted management networks).
  • Change or remove default/hardcoded credentials where possible and monitor for their use.
  • Enable enhanced logging and consider network segmentation for backup/recovery appliances.

Due to the critical severity and prolonged exploitation, immediate action and post-compromise forensics are strongly recommended for exposed systems.