Critical Dell ObjectScale Vulnerabilities Allows Malicious Users to Compromise the Affected system
Dell's DSA-2026-393 fixes ObjectScale/ECS flaws including unauthenticated deserialization RCE CVE-2026-70416 rated CVSS 10.0.
65
Vulnerability1 · 1 read
CVE-2026-76104
Incorrect OS Permission Assignment in Dell ObjectScale Enables Privileged Denial of Service
- CVSS 3.1
- 5.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Dell ObjectScale, Dell's Kubernetes-based software-defined object storage platform, versions prior to 4.4.0.0 contain an incorrect permission assignment for a critical OS resource (CWE-732). The flaw can be triggered by an attacker who already holds high privileges and has remote access to the system, by acting on improperly protected OS resources. Successful exploitation primarily results in denial of service (high availability impact, with a minor integrity impact per the CVSS vector), which could disrupt object storage services. Only organizations running affected ObjectScale releases are exposed, and the attacker must already be highly privileged, limiting the realistic attack surface. No public proof-of-concept is known, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported.
What to do: Upgrade Dell ObjectScale to version 4.4.0.0 or later. Restrict remote access to high-privileged accounts and management interfaces (VPN, allow-listing, MFA), since exploitation requires high privileges, and audit administrative accounts for unusual activity. Monitor for storage service disruptions or restarts that could indicate exploitation.
| Product | Affected |
|---|---|
| Dell ObjectScale | all versions prior to 4.4.0.0 |
Estimated exposure
nichelikely a few hundred to a few thousand enterprise object-storage deployments — Dell ObjectScale is a relatively new, enterprise-focused software-defined storage product with a limited private install base and no public internet-exposure scan data, so the estimate is based on typical deployment counts for this product…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.