Critical Dell ObjectScale Vulnerabilities Allows Malicious Users to Compromise the Affected system
Dell's DSA-2026-393 fixes ObjectScale/ECS flaws including unauthenticated deserialization RCE CVE-2026-70416 rated CVSS 10.0.
Dell advisory DSA-2026-393 (September 10, 2026) covers multiple flaws in ObjectScale and Elastic Cloud Storage (ECS). CVE-2026-70416 is a critical untrusted-data deserialization RCE (CVSS 10.0) in ObjectScale before 4.4.0.0 allowing unauthenticated remote code execution and full environment takeover, credited to researcher WinD39 (Huynh Dinh Vu). Additional issues include CVE-2025-43936 improper authentication (8.1), CVE-2026-26947 privilege management (6.7), CVE-2026-36591-style weak crypto CVE-2025-36591 (4.4), CVE-2026-76104 permission assignment DoS (5.5), plus third-party CVEs in Apache Log4j, liblzma, and the Linux kernel. Dell advises upgrading to version 4.4.0.0 or later (or 4.2.0.1) and restricting management interfaces until patched.
- CVE-2026-70416: unauthenticated deserialization RCE, CVSS 10.0
- Affects Dell ObjectScale and ECS before 4.4.0.0
- Additional authentication, privilege, crypto, and DoS flaws disclosed
- Upgrade to 4.4.0.0+; restrict admin and storage-management interfaces meanwhile
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-36591 | NVD description · AI analysis pending | — | — | — | — | — | |
| CVE-2025-43936 | NVD description · AI analysis pending | — | — | — | — | — | |
| CVE-2026-26947 | NVD description · AI analysis pending | — | — | — | — | — | |
| CVE-2026-31694 | In the Linux kernel, the following vulnerability has been resolved: In the Linux kernel, the following vulnerability has been resolved: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size from the server-controlled namelen field and copies the dirent into a single page-cache page. The existing logic only checks whether the dirent fits in the remaining space of the current page and advances to a fresh page if not. It never checks whether the dirent itself exceeds PAGE_SIZE. As a result, a malicious FUSE server can return a dirent with namelen=4095, producing a serialized record size of 4120 bytes. On 4 KiB page systems this causes memcpy() to overflow the cache page by 24 bytes into the following kernel page. Reject dirents that cannot fit in a single page before copying them into the readdir cache. NVD description · AI analysis pending | 7.8 | <1% | PoC |
| — | |
| CVE-2026-34478 | Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to l Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. Two distinct issues affect users of stream-based syslog services who configure Rfc5424Layout directly: * The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output. * The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping. Users of the SyslogAppender are not affected, as its configuration attributes were not modified. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue. NVD description · AI analysis pending | 6.9 group max | <1% |
| — | ||
| CVE-2026-34743 | XZ Utils provide a general-purpose data-compression library plus command-line tools. XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3. NVD description · AI analysis pending | 1.7 | <1% |
| — | ||
| CVE-2026-43499 | In the Linux kernel, the following vulnerability has been resolved: In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ] NVD description · AI analysis pending | 7.8 | <1% | PoC ×4 |
| — | |
| CVE-2026-70416 | NVD description · AI analysis pending | — | — | — | — | — | |
| CVE-2026-76104 | NVD description · AI analysis pending | — | — | — | — | — |
Full article483 words · extracted from cybersecuritynews.com · click to collapse
Dell Technologies released a security advisory about multiple vulnerabilities affecting Dell ObjectScale and Elastic Cloud Storage (ECS) deployments.
Including a critical remote code execution flaw that could let an unauthenticated attacker compromise vulnerable systems. The advisory, tracked as DSA-2026-393, was published on September 10, 2026.
The most severe issue is CVE-2026-70416, a critical untrusted-data deserialization vulnerability in Dell ObjectScale versions earlier than 4.4.0.0. The flaw carries a CVSS score of 10.0. It could allow an unauthenticated remote attacker to execute code on an affected system.
Successful exploitation could give an attacker control over the ObjectScale environment, enabling them to access data, alter configurations, disrupt storage operations, deploy malicious payloads, or establish persistence in the affected infrastructure.
ObjectScale provides enterprise-scale object storage, so a compromise could be significant for organizations that store backups, application data, archives, or cloud-native workloads on the platform.
Dell ObjectScale Vulnerabilities
Dell’s advisory also details CVE-2025-43936, an improper authentication vulnerability rated 8.1. The flaw affects ObjectScale versions before 4.4.0.0 and may allow an unauthenticated attacker with remote access to gain unauthorized access.
Although its attack complexity is rated high, the vulnerability does not require credentials or user interaction, increasing the importance of limiting network exposure while updates are deployed.
Two additional flaws affect both Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions earlier than 4.4.0.0. CVE-2026-26947 is an improper privilege management flaw with a CVSS score of 6.7.
A local attacker with high privileges could exploit it to elevate privileges further and affect confidentiality, integrity, and availability.
CVE-2025-36591 is a broken or risky cryptographic algorithm vulnerability rated 4.4. Dell said a high-privileged local attacker could potentially exploit the issue to expose sensitive information.
Another issue, CVE-2026-76104, is an incorrect permission assignment vulnerability in the operating system. It has a CVSS score of 5.5 and could allow a high-privileged remote attacker to cause denial-of-service conditions.
The advisory also lists third-party component vulnerabilities involving Apache Log4j, liblzma, and the Linux kernel. These include CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, CVE-2026-34743, CVE-2026-31694, and CVE-2026-43499.
Dell recommends that customers upgrade affected ObjectScale and ECS systems to version 4.4.0.0 or later as soon as possible. Customers running supported affected releases may also upgrade directly to version 4.2.0.1. Organizations should open an Operating Environment Upgrade service request and reference DSA-2026-393.
Until updates are applied, Dell recommends using the Secure Service-Level Communication guidance in the official Security Configuration Guide to mitigate CVE-2025-43936.
Security teams should also restrict administrative and storage-management interfaces to trusted networks, review exposed ObjectScale services, monitor for abnormal authentication activity, and investigate unexpected configuration or permission changes. Dell credited security researcher WinD39, also known as Huynh Dinh Vu, for reporting CVE-2026-70416.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Abinayahttps://cybersecuritynews.com/
Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/dell-objectscale-vulnerabilities/