On 2026-09-10 Dell Technologies published security advisory DSA-2026-393, covering five vulnerabilities in ObjectScale (and, for several of the flaws, the related Elastic Cloud Storage/ECS product line). The headline issue, CVE-2026-70416, is a CVSS 10.0 untrusted-data deserialization vulnerability (CWE-502) affecting all ObjectScale versions prior to 4.4.0.0. Because the flaw requires no authentication and no user interaction, a remote attacker can send malicious serialized data to trigger the vulnerable deserialization path and achieve arbitrary code execution on the target system. Dell's own advisory language states that successful exploitation could give the attacker control over the ObjectScale environment, enabling them to access data, alter configurations, disrupt storage operations, deploy malicious payloads, or establish persistence in the affected infrastructure -- effectively full compromise of the storage platform.

The same advisory bundles a second high-severity, unauthenticated issue, CVE-2025-43936 (CVSS 8.1), an improper-authentication flaw (CWE-287) that also permits unauthorized remote access to ObjectScale (and ECS 3.8.1.0-3.8.1.7), though it requires high attack complexity to exploit versus the trivial CVE-2026-70416. Three additional, lower-severity issues round out DSA-2026-393: CVE-2026-26947 (CVSS 6.7, improper privilege management, CWE-269, requires a high-privileged local attacker, affects ECS 3.8.1.0-3.8.1.7 and ObjectScale < 4.4.0.0, impacting confidentiality, integrity, and availability once escalated), CVE-2026-76104 (CVSS 5.5, incorrect permission assignment for a critical resource, CWE-732, described in independent reporting as an operating-system-level permission flaw rather than a purely application-layer bug, exploitable by a remote high-privileged administrator to cause denial-of-service conditions by altering that resource's permissions), and CVE-2025-36591 (CVSS 4.4, use of a broken/weak cryptographic algorithm, CWE-327, requiring local access and high privileges, leading to sensitive information exposure).

DSA-2026-393 additionally bundles fixes for third-party components shipped inside ObjectScale -- Apache Log4j (CVE-2026-34477, CVE-2026-34478, CVE-2026-34480), liblzma/XZ Utils (CVE-2026-34743), and the underlying Linux kernel (CVE-2026-31694, CVE-2026-43499) -- reflecting that a full remediation also pulls in upstream component patches, not just Dell proprietary code changes. No exploitation mechanism, attack vector, or CVSS-vector detail beyond the CVE IDs themselves was found in the reviewed reporting for these six bundled third-party CVEs, so they are tracked here as remediation-relevant context rather than independently analyzed vulnerabilities.

Dell credits security researcher WinD39 (Huynh Dinh Vu) for reporting CVE-2026-70416 through Dell's coordinated vulnerability disclosure program. No public proof-of-concept and no confirmed in-the-wild exploitation have been reported for any of the five CVEs as of this writing. As of 2026-09-13, direct verification against the NVD CVE 2.0 REST API (services.nvd.nist.gov) returned zero populated records for CVE-2026-70416, CVE-2025-43936, CVE-2026-26947, CVE-2026-76104, and CVE-2025-36591, and the CVE.org record pages for these IDs likewise had not yet rendered scored/structured content -- indicating the federal vulnerability databases have not finished ingesting and scoring this three-day-old disclosure, so Dell's own advisory and independent security-media reporting remain the primary available sources. Dell's remediation guidance is to upgrade to ObjectScale 4.4.0.0 or later (customers on supported release trains may instead upgrade directly to 4.2.0.1), and, pending patching, to restrict administrative and storage-management interfaces to trusted networks, monitor for abnormal authentication activity, and investigate unexpected configuration or permission changes.

ObjectScale and ECS are Dell's enterprise S3-compatible object-storage platforms, marketed for cloud-native, AI/analytics, big-data, backup/archive, and data-lake workloads in VMware and Red Hat OpenShift environments, with a customer base that includes enterprise, government, and research-institution deployments -- meaning a compromised, internet- or internal-network-exposed management interface could expose, corrupt, or destroy large volumes of an organization's primary data-lake or backup storage.