Dell Recover Point for VMs Zero-Day CVE-2026-22769 Exploited Since Mid-2024
Summary: Google Mandiant and GTIG report that a suspected China-nexus cluster, UNC6201, has exploited CVE-2026-22769 - a CVSS 10.0 hard-coded credential flaw in Dell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1 - as a zero-day since mid-2024. The hard-coded 'admin' credential for the Apache Tomcat Manager instance let attackers upload a web shell called SLAYSTYLE and run commands as root to install the BRICKSTORM backdoor and its successor GRIMBOLT, with CISA adding the flaw to its KEV catalog on February 18, 2026 and setting a February 21, 2026 patch deadline for FCEB agencies.
Why it matters: Mandiant says the actor is likely still active in unpatched and remediated environments, and with exploitation running since mid-2024 it has had significant time to establish persistence and conduct long-term espionage - while UNC6201's use of temporary 'Ghost NICs' and targets that lack EDR agents keeps the dwell time long and the forensic trail thin.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-22769
- Related
- CVE-2026-22769: Dell Recover Point for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability Known Exploited Vulnerabilities · Feb 18, 2026