EUVD-2026-29043
GHSA-gm85-wrgm-h2qc
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper privilege management vulnerability in the OS. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.
AnalysisAI
Improper privilege management in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale prior to 4.3.0.0 allows high-privileged local attackers to escalate privileges and gain full system access, affecting confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at the time of analysis.
Technical ContextAI
Dell ECS (Elastic Cloud Storage) and ObjectScale are enterprise object storage platforms. The vulnerability stems from improper privilege management (CWE-269) in the operating system layer, a root-cause classification indicating insufficient controls over privilege assignment, delegation, or verification. The local attack vector combined with high privilege requirement suggests the flaw exists in a privileged service or kernel component that processes requests from high-privileged system accounts or administrators. Attackers who have already achieved high-privilege status on the host OS can exploit this flaw to escalate further or gain unintended capabilities, potentially bypassing intended privilege boundaries within the storage system.
RemediationAI
For Dell ObjectScale, upgrade to version 4.3.0.0 or later - the patch version confirmed in Dell's advisory. For Dell ECS, apply the security update referenced in Dell Security Advisory DSA-2026-047 (https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1). If patching is not immediately feasible, restrict administrative access to ECS and ObjectScale systems to only essential personnel, implement robust authentication mechanisms (multi-factor authentication for admin accounts), and monitor privileged account activity and privilege escalation attempts through OS-level auditing. These compensating controls reduce exposure but do not eliminate the vulnerability - they are temporary measures pending patch deployment.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
d4d/uploader.php in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 allows remote at
Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privile
Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today