CVE-2026-40712 describes an improper input validation vulnerability (CWE-20) in Dell PowerProtect Data Manager's REST API affecting versions before 20.2.0.0. A remote attacker with high privileges could exploit this vulnerability to achieve elevation of privileges. The vulnerability has a critical CVSS 3.1 score of 9.1, indicating network attack vector, low attack complexity, no user interaction, and impacts confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation could lead to elevation of privileges by a high privileged remote attacker, potentially compromising confidentiality, integrity, and availability of the affected system. This could allow unauthorized actions beyond the attacker's original permissions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote access to the REST API to trusted users and networks, and monitor for suspicious activity involving privilege escalation attempts.