CVE-2026-26947

Dell ECS and Dell ObjectScale contain an improper privilege management vulnerability (CWE-269) that allows an attacker who already has high privileges and local access to the system to elevate those privileges. Because the CVSS vector requires local access and high existing privileges, exploitation is limited to users or compromised accounts that already have substantial control over the storage platform, but a successful attack yields full high-impact access (high confidentiality, integrity, and availability impact). Affected products are Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.4.0.0; ObjectScale is Dell's Kubernetes-based successor to the ECS object storage platform, so both product lines are deployed primarily in enterprise data centers. There are no reports of in-the-wild exploitation, the flaw is not in CISA KEV, and no public proof-of-concept is known.

What to do: Upgrade Dell ObjectScale to version 4.4.0.0 or later and upgrade ECS to a release beyond 3.8.1.7 as specified in Dell's security advisory. Because exploitation requires local access with high privileges, restrict and audit management-plane and SSH access to ECS/ObjectScale nodes, limit the number of high-privileged storage accounts, and monitor privileged activity for anomalies. Follow Dell's advisory (CNA: Dell/emc security team) for exact fixed builds and any interim mitigations.