CVE-2026-28264 Information disclosure in PowerProtect Agent
A local low-privileged attacker can exploit incorrect permissions to expose sensitive information in Dell PowerProtect Agent.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-28264?
CVE-2026-28264 is a low-severity vulnerability in Dell PowerProtect Agent, published on 8 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dell PowerProtect Agent Service, version(s) prior to 20.1, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
Weakness: CWE-732
Which versions are affected by CVE-2026-28264?
It affects 1 product.
Products include Dell Powerprotect Data Manager.
How do I fix CVE-2026-28264?
No fix has been published for CVE-2026-28264 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-28264 being exploited?
There is no known exploitation of CVE-2026-28264 in the wild and no public exploit code.
Other vulnerabilities in Dell PowerProtect Agent
- CVE-2026-40712 Privilege escalation in PowerProtect Data Manager
- CVE-2026-46738 Privilege escalation in PowerProtect Data Manager
- CVE-2026-49499 Privilege escalation in PowerProtect Data Manager
- CVE-2025-43888 Information disclosure in PowerProtect Data Manager
- CVE-2024-22454 Auth bypass in PowerProtect Data Manager
Sources
Also known as GHSA-gg8q-457x-wh9p.