CISA gives federal agencies three days to patch actively exploited Dell bug
(2026/02/20)
- Reference: 1771589590
- News link: https://www.theregister.co.uk/2026/02/20/cisa_dell_vulnerability/
- Source link:
Uncle Sam's cyber defenders have given federal agencies just three days to patch a maximum-severity Dell bug that's been under active exploitation since at least mid-2024.
CISA this week added the flaw, tracked as CVE-2026-22769, [1]to its Known Exploited Vulnerabilities catalog , ordering civilian agencies to secure affected systems by February 21 – giving them just three days to get fixes in place.
"These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA warned, underscoring the urgency behind the unusually tight remediation window.
[2]
The bug affects Dell RecoverPoint for Virtual Machines and stems from hardcoded credentials that can allow attackers to gain unauthorized access. [3]Dell disclosed and patched the issue earlier this week , noting that criminals had already been exploiting it before a fix was available.
[4]
[5]
"We have received a report of limited active exploitation of this vulnerability," a Dell spokesperson told The Register at the time, urging customers to get the recommended mitigations in place pronto.
Researchers say the bug quickly found its way into a broader espionage playbook tied to suspected China-nexus operators. According to Google's Mandiant incident response team, miscreants have exploited the vulnerability since at least mid-2024 to move laterally across networks, maintain persistence, and deploy a range of malware families.
[6]Texas sues TP-Link over China links and security vulnerabilities
[7]China-linked snoops have been exploiting Dell 0-day since mid-2024, using 'ghost NICs' to avoid detection
[8]Attackers finally get around to exploiting critical Microsoft bug from 2024
[9]Were telcos tipped off to *that* ancient Telnet bug? Cyber pros say the signs stack up
Among the tools seen in the wild are the Brickstorm backdoor and a newer implant called Grimbolt, which, in some cases, has been swapped in for older malware. Researchers also spotted attackers spinning up so-called "Ghost NICs" on virtual machines to quietly pivot around compromised environments without tripping alarms.
A cluster tracked as UNC6201 has used the flaw to deploy multiple payloads, including Slaystyle, Brickstorm, and Grimbolt, during long-running intrusions, according to Mandiant. The firm says it knows of fewer than a dozen confirmed victims so far, though the true number could be higher.
[10]
Mandiant says the activity shares some hallmarks with Silk Typhoon, a Chinese state-backed espionage crew known for targeting government agencies and previously tied to breaches involving custom malware. The group has repeatedly exploited zero-day bugs to break into sensitive networks, including US federal systems.
The latest directive continues a pattern of rapid-fire patch orders from CISA as it tries to shrink the window between disclosure and remediation for actively exploited bugs. Just last week, the agency similarly gave federal agencies three days to lock down BeyondTrust Remote Support instances against a separate remote code execution flaw.
When CISA slaps a bug on the KEV list with a three-day deadline, it's less a gentle reminder and more a flashing neon sign that says patch now, ask questions later. ®
Get our [11]Tech Resources
[1] https://www.cisa.gov/known-exploited-vulnerabilities-catalog
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aZiTNjTVGpasd3I8RggLPgAAAtc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2026/02/18/dell_0day_brickstorm_campaign/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZiTNjTVGpasd3I8RggLPgAAAtc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZiTNjTVGpasd3I8RggLPgAAAtc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2026/02/18/texas_sues_tplink_over_china/
[7] https://www.theregister.com/2026/02/18/dell_0day_brickstorm_campaign/
[8] https://www.theregister.com/2026/02/13/critical_microsoft_bug_from_2024/
[9] https://www.theregister.com/2026/02/11/were_telcos_tipped_off_to/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZiTNjTVGpasd3I8RggLPgAAAtc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://whitepapers.theregister.com/
CISA this week added the flaw, tracked as CVE-2026-22769, [1]to its Known Exploited Vulnerabilities catalog , ordering civilian agencies to secure affected systems by February 21 – giving them just three days to get fixes in place.
"These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA warned, underscoring the urgency behind the unusually tight remediation window.
[2]
The bug affects Dell RecoverPoint for Virtual Machines and stems from hardcoded credentials that can allow attackers to gain unauthorized access. [3]Dell disclosed and patched the issue earlier this week , noting that criminals had already been exploiting it before a fix was available.
[4]
[5]
"We have received a report of limited active exploitation of this vulnerability," a Dell spokesperson told The Register at the time, urging customers to get the recommended mitigations in place pronto.
Researchers say the bug quickly found its way into a broader espionage playbook tied to suspected China-nexus operators. According to Google's Mandiant incident response team, miscreants have exploited the vulnerability since at least mid-2024 to move laterally across networks, maintain persistence, and deploy a range of malware families.
[6]Texas sues TP-Link over China links and security vulnerabilities
[7]China-linked snoops have been exploiting Dell 0-day since mid-2024, using 'ghost NICs' to avoid detection
[8]Attackers finally get around to exploiting critical Microsoft bug from 2024
[9]Were telcos tipped off to *that* ancient Telnet bug? Cyber pros say the signs stack up
Among the tools seen in the wild are the Brickstorm backdoor and a newer implant called Grimbolt, which, in some cases, has been swapped in for older malware. Researchers also spotted attackers spinning up so-called "Ghost NICs" on virtual machines to quietly pivot around compromised environments without tripping alarms.
A cluster tracked as UNC6201 has used the flaw to deploy multiple payloads, including Slaystyle, Brickstorm, and Grimbolt, during long-running intrusions, according to Mandiant. The firm says it knows of fewer than a dozen confirmed victims so far, though the true number could be higher.
[10]
Mandiant says the activity shares some hallmarks with Silk Typhoon, a Chinese state-backed espionage crew known for targeting government agencies and previously tied to breaches involving custom malware. The group has repeatedly exploited zero-day bugs to break into sensitive networks, including US federal systems.
The latest directive continues a pattern of rapid-fire patch orders from CISA as it tries to shrink the window between disclosure and remediation for actively exploited bugs. Just last week, the agency similarly gave federal agencies three days to lock down BeyondTrust Remote Support instances against a separate remote code execution flaw.
When CISA slaps a bug on the KEV list with a three-day deadline, it's less a gentle reminder and more a flashing neon sign that says patch now, ask questions later. ®
Get our [11]Tech Resources
[1] https://www.cisa.gov/known-exploited-vulnerabilities-catalog
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aZiTNjTVGpasd3I8RggLPgAAAtc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2026/02/18/dell_0day_brickstorm_campaign/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZiTNjTVGpasd3I8RggLPgAAAtc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZiTNjTVGpasd3I8RggLPgAAAtc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2026/02/18/texas_sues_tplink_over_china/
[7] https://www.theregister.com/2026/02/18/dell_0day_brickstorm_campaign/
[8] https://www.theregister.com/2026/02/13/critical_microsoft_bug_from_2024/
[9] https://www.theregister.com/2026/02/11/were_telcos_tipped_off_to/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZiTNjTVGpasd3I8RggLPgAAAtc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://whitepapers.theregister.com/
Re: Not a bug
Trev 2
Probably also find the person who wrote that bit of code has mysteriously left the country on a flight to China.
Re: Not a bug
VoiceOfTruth
It is indeed not a bug. It is a deliberate backdoor. But it only became a 'problem' when China discovered it.
Until then it was likely exploited by the American regime.
Magically, none of the American internet 'security' companies discovered or reported it although it has been around since at least mid-2024. Hmmm. If Google's Mandiant was aware of this, why did they not report it? Google is an NSA partner, is why.
Not a bug
Hard coded credentials in an application is not a bug. It's called utterly irresponsible software development and a total management fail to allow the application to be released with hard coded credentials in it.