AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Dell TechnologiesCVE-2026-49809

Dell Technologies Cyber Recovery: SQL injection

Dell Technologies

CVE-2026-49809 · Published Aug 26, 2026 · updated Sep 2, 2026

Medium6.5
Fix: upgrade to Power Protect Cyber Recovery 20.3.0.0 or later (3 fixed versions below)
Dell Technologies advisory

Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

Affected versions

PackageAffectedFixed in
Cyber Recovery
Product
< osupdate-15.4.0-19.binosupdate-15.4.0-19.bin
< osupdate-15.6.1-1.binosupdate-15.6.1-1.bin
Power Protect Cyber Recovery
Product
< 20.3.0.020.3.0.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-89

More Dell Technologies advisories

All Dell Technologies
High 7.6Aug 26Dell Technologies Cyber Recovery: improper authenticationCVE-2026-79938fixed in Power Protect Cyber Recovery 20.3.0.0 +2Medium 5.8Aug 26Dell PowerProtect Cyber RecoveryCVE-2026-79939fixed in Power Protect Cyber Recovery 20.3.0.0 +2Medium 4.3Aug 26Dell Technologies Cloud Disaster Recovery: server-side request forgeryCVE-2026-71172fixed in CDR 20.3High 8.8Aug 26Dell Technologies PowerProtect One: command injectionCVE-2026-74770fixed in 20.3.0.0Medium 6.5Aug 26Dell Technologies PowerProtect One: tamperingCVE-2026-74771fixed in 20.3.0.0Medium 5.9Aug 26Dell Technologies PowerProtect One: improper certificate validationCVE-2026-74774fixed in 20.3.0.0