Dell has released fixes for a group of security weaknesses in ObjectScale and Elastic Cloud Storage, led by a maximum-severity flaw that could give an unauthenticated remote attacker control of a vulnerable storage environment. The central issue, tracked as CVE-2026-70416, carries a CVSS score of 10.0 and affects Dell ObjectScale releases earlier than 4.4.0.0.

The risk is unusually serious because ObjectScale is designed to hold large volumes of enterprise data, including backups, archives, application objects and cloud-native workloads. A successful attack would therefore threaten more than a single server: it could place business data, recovery material and dependent applications within an intruder’s reach.

Unsafe deserialization creates a remote execution path

CVE-2026-70416 is an untrusted-data deserialization vulnerability. In practical terms, a vulnerable service may reconstruct attacker-controlled data as an internal object without applying adequate safety checks. A remote adversary able to reach the affected component could exploit that behavior to run code without first supplying credentials or persuading a user to open a file.

Code execution could allow an intruder to inspect stored objects, alter system settings, interrupt storage operations, install additional malicious tools or establish persistence. The absence of authentication lowers the initial barrier to exploitation, making network reachability and rapid patching especially important. Dell credited researcher WinD39, also known as Huynh Dinh Vu, with reporting the flaw.

Additional weaknesses widen the exposure

Dell’s DSA-2026-393 advisory addresses several other issues. CVE-2025-43936 is an improper-authentication vulnerability rated 8.1. Although exploitation is considered complex, it may permit remote access without valid credentials on ObjectScale versions before 4.4.0.0.

Two lower-severity weaknesses affect both ObjectScale and certain ECS 3.8.1.x releases. CVE-2026-26947 concerns privilege management and could let a highly privileged local user gain additional authority. CVE-2025-36591 involves the use of a weak or risky cryptographic algorithm and may expose sensitive information to a privileged local attacker. CVE-2026-76104, meanwhile, is an operating-system permission issue that could enable a highly privileged remote actor to cause a denial of service.

The update also includes corrections for third-party components such as Apache Log4j, liblzma and the Linux kernel. This broader set of fixes is a reminder that storage platforms inherit risk from the software layers bundled inside the appliance, even when customers do not interact with those components directly.

Upgrade and isolate the management plane

Dell recommends moving affected ObjectScale and ECS deployments to version 4.4.0.0 or later as soon as operationally possible. Supported environments may also have a direct path to version 4.2.0.1, and customers are advised to open an Operating Environment Upgrade service request referencing DSA-2026-393. Administrators should confirm the appropriate target release for their deployment rather than assuming that every upgrade path is identical.

• Restrict administrative and storage-management interfaces to trusted networks and approved operators.
• Inventory ObjectScale and ECS versions, including systems used for backup or disaster recovery.
• Review authentication logs, unexpected permission changes and newly altered configurations.
• Apply Dell’s secure service-level communication guidance while remediation is being scheduled.

Storage security is also recovery security

Enterprise object stores often sit at the intersection of production data and recovery plans. If an attacker can manipulate both live objects and backups, a conventional incident can become a prolonged business disruption. Security teams should therefore treat this advisory as an infrastructure priority, coordinate the change with storage owners and verify that monitoring covers the management plane as well as ordinary data access.

The immediate goal is to remove the vulnerable code. The longer-term lesson is to minimize who and what can reach storage-control interfaces, enforce strong separation between administration and application traffic, and preserve offline or otherwise isolated recovery copies. Those controls can reduce the impact even when a future vulnerability arrives before a patch.

Source: Cyber Security News.