How severe is CVE-2026-79939?

CVE-2026-79939 has a CVSS 3.x base score of 5.8, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.

Is CVE-2026-79939 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-79939?

CVE-2026-79939 affects Dell Powerprotect Cyber Recovery. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-79939?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2026-79939 published?

CVE-2026-79939 was published on 2026-08-26 and last updated on 2026-09-01.

CVE-2026-79939

CVE-2026-79939 is a medium-severity vulnerability in Dell Powerprotect Cyber Recovery with a CVSS 3.x base score of 5.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-61.

Key facts

Severity: Medium (CVSS 3.x base score 5.8)
EPSS exploit prediction: 0% (6th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-61
Affected product: Dell Powerprotect Cyber Recovery
Published: 2026-08-26
Last modified: 2026-09-01

Description

Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection.

Frequently asked questions

What is CVE-2026-79939?: Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection.
How severe is CVE-2026-79939?: CVE-2026-79939 has a CVSS 3.x base score of 5.8, rated medium severity. It is exploitable over local access with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability low.
Is CVE-2026-79939 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (6th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-79939?: CVE-2026-79939 affects Dell Powerprotect Cyber Recovery. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-79939?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2026-79939 published?: CVE-2026-79939 was published on 2026-08-26 and last updated on 2026-09-01.

References

https://www.dell.com/support/kbdoc/en-us/000501456/dsa-2026-370-security-update-for-dell-powerprotect-cyber-recovery-multiple-third-party-component-vulnerabilities

Affected products (1)

cpe:2.3:a:dell:powerprotect_cyber_recovery:*:*:*:*:*:*:*:*

More vulnerabilities in Dell Powerprotect Cyber Recovery

CVE-2022-34372 — Critical (CVSS 9.8): Dell PowerProtect Cyber Recovery versions before 19.11.0.2 contain an authentication bypass vulnerability. A remote…
CVE-2023-32465 — High (CVSS 8.8): Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. An attacker could potentially…
CVE-2022-32481 — High (CVSS 7.8): Dell PowerProtect Cyber Recovery, versions prior to 19.11, contain a privilege escalation vulnerability on virtual…
CVE-2026-79938 — High (CVSS 7.6): Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low…
CVE-2026-49809 — Medium (CVSS 6.5): Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used…
CVE-2025-26335 — Medium (CVSS 5.8): Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive Information Into Sent…

All CVEs affecting Dell Powerprotect Cyber Recovery →

Other CWE-61 vulnerabilities

CVE-2026-34078 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths…
CVE-2025-62596 — Critical (CVSS 10.0): Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs…
CVE-2025-62161 — Critical (CVSS 10.0): Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source…
CVE-2026-91099 — Critical (CVSS 9.8): HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several…
CVE-2025-23394 — Critical (CVSS 9.8): A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus…
CVE-2024-54661 — Critical (CVSS 9.8): readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file.

Browse all CWE-61 vulnerabilities →