Critical Dell ObjectScale Vulnerabilities Allows Malicious Users to Compromise the Affected system
Dell's DSA-2026-393 fixes ObjectScale/ECS flaws including unauthenticated deserialization RCE CVE-2026-70416 rated CVSS 10.0.
Dell advisory DSA-2026-393 (September 10, 2026) covers multiple flaws in ObjectScale and Elastic Cloud Storage (ECS). CVE-2026-70416 is a critical untrusted-data deserialization RCE (CVSS 10.0) in ObjectScale before 4.4.0.0 allowing unauthenticated remote code execution and full environment takeover, credited to researcher WinD39 (Huynh Dinh Vu). Additional issues include CVE-2025-43936 improper authentication (8.1), CVE-2026-26947 privilege management (6.7), CVE-2026-36591-style weak crypto CVE-2025-36591 (4.4), CVE-2026-76104 permission assignment DoS (5.5), plus third-party CVEs in Apache Log4j, liblzma, and the Linux kernel. Dell advises upgrading to version 4.4.0.0 or later (or 4.2.0.1) and restricting management interfaces until patched.
- CVE-2026-70416: unauthenticated deserialization RCE, CVSS 10.0
- Affects Dell ObjectScale and ECS before 4.4.0.0
- Additional authentication, privilege, crypto, and DoS flaws disclosed
- Upgrade to 4.4.0.0+; restrict admin and storage-management interfaces meanwhile
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-26947+1 related CVE | Improper Privilege Management Elevation Flaw in Dell ECS and ObjectScale | 6.7 group max | — | ||
CVE-2026-70416+2 related CVEs | Unauthenticated Deserialization RCE in Dell ObjectScale | 9.8 group max | — | ||
| CVE-2026-31694 | Linux kernel: fuse: reject oversized dirents in page cache fuse_add_dirent_to_cache() computes a serialized dirent size… | 7.8 | <1% | PoC | |
CVE-2026-34478+2 related CVEs | Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to… | 6.9 group max | <1% | ||
| CVE-2026-34743 | XZ Utils provide a general-purpose data-compression library plus command-line tools | 1.7 | <1% | ||
| CVE-2026-43499 | Linux kernel: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock… | 7.8 | <1% | PoC ×19 |
From the original article
2 min read at cybersecuritynews.com
Dell Technologies released a security advisory about multiple vulnerabilities affecting Dell ObjectScale and Elastic Cloud Storage (ECS) deployments. Including a critical remote code execution flaw that could let an unauthenticated attacker compromise vulnerable systems. The advisory, tracked as DSA-2026-393, was published on September 10, 2026.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.