CVE-2026-70416: Dell ObjectScale Deserialization Flaw Scores 10.0; Unauthenticated Takeover of Storage Clusters
Dell security advisory DSA-2026-393 discloses multiple vulnerabilities in ObjectScale and ECS. CVE-2026-70416 is untrusted-data deserialization, CVSS 10.0. An unauthenticated attacker can remotely execute code and fully take over the object-storage environment.
Dell Technologies published security advisory DSA-2026-393 on 10 September 2026, disclosing multiple vulnerabilities in Dell ObjectScale and Dell Elastic Cloud Storage (ECS). The most severe is CVE-2026-70416, an untrusted-data deserialization defect with CVSS 3.1 score 10.0. An unauthenticated remote attacker can execute arbitrary code on affected systems and fully take over the enterprise object-storage environment.
Incident Overview
ObjectScale is Dell's software-defined object-storage platform for cloud-native and Kubernetes workloads. ECS is the enterprise object-storage line, commonly used for backup, archive, application data, and container persistent storage. The advisory covers five numbered product vulnerabilities plus issues in third-party components including Apache Log4j, liblzma, and the Linux kernel (including CVE-2026-34477, CVE-2026-34478, CVE-2026-34480, and others). CVE-2026-70416 was reported by researcher WinD39 (Huynh Dinh Vu). Dell acknowledged the report in the advisory.
Technical Details
CVE-2026-70416 affects ObjectScale versions before 4.4.0.0. Root cause is deserialization of untrusted data without adequate validation. An attacker can send crafted data over the network to trigger arbitrary code execution with no credentials. Other issues in the same batch:
- CVE-2025-43936 (8.1, improper authentication): ObjectScale before 4.4.0.0; an unauthenticated remote attacker can obtain unauthorized access with no credentials and no user interaction;
- CVE-2026-26947 (6.7, improper privilege management): affects ECS 3.8.1.0 through 3.8.1.7 and ObjectScale before 4.4.0.0; a local attacker who already has high privileges can escalate further;
- CVE-2025-36591 (4.4, cryptographic-algorithm defect) and CVE-2026-76104 (5.5, incorrect privilege assignment): can lead to sensitive-information exposure and denial of service, respectively.
Impact Assessment
Blast radius of a 10.0 flaw depends on product placement. ObjectScale holds backup copies, archive data, and persistent volumes for cloud-native workloads. Once taken over, an attacker can read all stored content, tamper with backups to break recoverability, plant persistence, and use the storage cluster as a lateral-movement pivot. Compared with ordinary application servers, a storage platform holds both the data itself and restore capability. Ransomware groups have high interest in such targets. Dell has not stated in-the-wild exploitation, and reference data contains no public exploit code. No authentication is required and the path is clear, so practical risk only rises over time.
Remediation
- Upgrade ObjectScale and ECS to 4.4.0.0 or later; users on supported affected versions may first upgrade to 4.2.0.1;
- Submit an Operating Environment Upgrade service request per Dell guidance, citing advisory DSA-2026-393;
- Temporary mitigation for CVE-2025-43936: configure per the Secure Service-Level Communication guidance in the official Security Configuration Guide;
- Restrict management and storage-management interfaces to trusted networks; do not expose them directly on the public internet;
- Hunt exposure and logs, focusing on anomalous authentication records, unexpected configuration changes, and privilege changes.
References
- Cyber Security News: Critical Dell ObjectScale Vulnerabilities
- HackersRadar: Critical Dell ObjectScale flaw
- CyberNexora: Dell ObjectScale Critical RCE
- CyberSixt: Dell Warns of Critical ObjectScale Flaw