CVE-2026-70416

Dell ObjectScale, Dell's Kubernetes-based enterprise object storage platform, contains a deserialization of untrusted data flaw (CWE-502) in all versions prior to 4.4.0.0. An unauthenticated attacker with remote network access to a vulnerable deployment can supply maliciously crafted serialized data to trigger the flaw, requiring no credentials or user interaction. Successful exploitation results in remote code execution, and the CVSS scope change (S:C) with high confidentiality, integrity, and availability impacts indicates a compromise could extend beyond the vulnerable component to the wider cluster or host. All Dell ObjectScale deployments running versions before 4.4.0.0 are affected. There is currently no evidence of in-the-wild exploitation, no known public proof-of-concept, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.

What to do: Upgrade Dell ObjectScale to version 4.4.0.0 or later per Dell's security advisory. Until patched, restrict network access to ObjectScale management and service interfaces to trusted networks only, since the flaw is exploitable remotely without authentication. Review Dell's advisory for related ObjectScale fixes shipped in the same release and monitor for updates.