CVE-2026-40712 is an improper input validation vulnerability (CWE-20) in the REST API of Dell PowerProtect Data Manager. Versions prior to 20.2.0.0 are affected. A high privileged attacker with remote access could exploit this vulnerability to elevate privileges, potentially gaining higher access than intended. The CVSS v3.1 base score is 9.1, indicating critical severity with network attack vector, low attack complexity, high privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported. Patch or official remediation status is not confirmed from the provided data.

Successful exploitation allows a high privileged remote attacker to elevate their privileges, potentially compromising confidentiality, integrity, and availability of the system. This could lead to unauthorized administrative actions within Dell PowerProtect Data Manager.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote access to the REST API to trusted users only and monitor for suspicious activity from high privileged accounts.