Use of hard-coded credentials in RecoverPoint for Virtual Machines - CVE-2026-22769
Published: February 18, 2026
Vulnerability identifier: #VU123002
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-22769
CWE-ID: CWE-798
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to gain full access to vulnerable system.
The vulnerability exists due to presence of hard-coded credentials in application code. A remote unauthenticated attacker can access the affected system using the hard-coded credentials.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note, the vulnerability is being actively exploited in the wild.
Affected software
RecoverPoint for Virtual Machines
How to mitigate CVE-2026-22769
Install updates from vendor's website.
RecoverPoint for Virtual Machines - update to 6.0 SP3 P1 HF1