⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser Hijacks
Weekly recap led by actively exploited Cisco ISE auth-bypass CVE-2026-76460 (CVSS 10.0), plus Plugin4Shell AI-agent RCE and KREMLIN banking malware.
78
Vulnerability2 · 1 read
CVE-2025-43936
Improper Authentication in Dell ObjectScale Enables Unauthorized Access
- CVSS 3.1
- 9.1 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Dell ObjectScale, Dell's Kubernetes-based enterprise object storage platform, contains an improper authentication flaw (CWE-287) in versions prior to 4.4.0.0. An unauthenticated attacker with network access to the affected system could potentially exploit it, though the CVSS vector indicates high attack complexity. Successful exploitation leads to unauthorized access, with high impact on confidentiality, integrity, and availability per the CVSS 8.1 score. All deployments running ObjectScale versions before 4.4.0.0 are affected. As of this analysis, there is no evidence of exploitation in the wild, no public proof-of-concept, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.
What to do: Upgrade Dell ObjectScale to version 4.4.0.0 or later as published in Dell's security advisory. Until patched, restrict network access to ObjectScale management and service interfaces to trusted networks and review access logs for unexplained activity. Verify the currently deployed ObjectScale version, as only pre-4.4.0.0 releases are affected.
| Product | Affected |
|---|---|
| Dell ObjectScale | all versions prior to 4.4.0.0 |
Estimated exposure
nichelikely hundreds to a few thousand enterprise deployments globally, with only a small subset exposed to untrusted networks (unknown; no public scan data) — ObjectScale is a newer, enterprise-only private-cloud object storage platform with a small installed base typically deployed inside data centers rather than exposed to the internet, so internet-exposed instances are expected to be minimal.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
In the news
2 storiesCritical Dell ObjectScale Vulnerabilities Allows Malicious Users to Compromise the Affected system
Dell's DSA-2026-393 fixes ObjectScale/ECS flaws including unauthenticated deserialization RCE CVE-2026-70416 rated CVSS 10.0.
65