What is the CVSS score of CVE-2026-28261?

CVE-2026-28261 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Dell are affected by CVE-2026-28261?

Dell Elastic Cloud Storage and ObjectScale contain a local privilege escalation vulnerability allowing authenticated users to extract credentials from log files and gain elevated privileges.. A patch is available.

How to fix or mitigate CVE-2026-28261?

Within 24 hours: Identify all systems running Dell Elastic Cloud Storage ≤3.8.1.7 or ObjectScale <4.1.0.3 and =4.2.0.0 in your environment. Within 7 days: Apply vendor patches (Elastic Cloud Storage 3.8.1.8 or later; ObjectScale 4.1.0.3 or 4.2.0.1 or later). Within 30 days: Conduct audit of privileged account activity and log file access controls on patched systems; implement file permission restrictions on log directories containing credentials.

Dell CVE-2026-28261

EUVD-2026-20468 HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2026-04-08 dell

Dell Information Disclosure Elastic

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:02 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.1.0.3,4.2.0.1

EUVD ID Assigned

Apr 08, 2026 - 13:16 euvd

EUVD-2026-20468

Analysis Generated

Apr 08, 2026 - 13:16 vuln.today

CVE Published

Apr 08, 2026 - 12:43 nvd

HIGH 7.8

DescriptionCVE.org

Dell Elastic Cloud Storage, version 3.8.1.7 and prior, and Dell ObjectScale, versions prior to 4.1.0.3 and version 4.2.0.0, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to secret exposure. The attacker may be able to use the exposed secret to access the vulnerable system with privileges of the compromised account.

AnalysisAI

Local privilege escalation in Dell Elastic Cloud Storage (≤3.8.1.7) and ObjectScale (<4.1.0.3, =4.2.0.0) allows authenticated users with low privileges to extract credentials from log files and escalate to compromised account privileges. CVSS 7.8 (High). No public exploit identified at time of analysis. EPSS data not available, but local access requirement and low attack complexity suggest moderate exploitation likelihood in multi-tenant or shared administrative environments.

Technical ContextAI

This vulnerability stems from CWE-532 (Insertion of Sensitive Information into Log File), a common logging misconfiguration where applications write authentication credentials, API tokens, or cryptographic secrets to diagnostic logs in cleartext or insufficiently protected formats. Dell Elastic Cloud Storage and ObjectScale are enterprise object storage platforms designed for petabyte-scale unstructured data management, often deployed in multi-tenant cloud infrastructures. The affected CPE strings (cpe:2.3:a:dell:elastic_cloud_storage and cpe:2.3:a:dell:objectscale) indicate both standalone ECS appliances and containerized ObjectScale deployments are vulnerable. The CVSS vector (AV:L/AC:L/PR:L) confirms exploitation requires local system access with low-privileged credentials, typical in environments where multiple administrators, DevOps engineers, or support personnel share access to storage management interfaces or underlying operating systems. Attackers gaining access to log files-via misconfigured file permissions, backup archives, or log aggregation systems-can extract valid credentials and authenticate as higher-privileged accounts without triggering audit alarms.

RemediationAI

Vendor-released patches: Upgrade Dell Elastic Cloud Storage to version 3.8.1.8 or later (specific fixed version not enumerated in advisory but implied by 'prior to 3.8.1.7' vulnerability scope). For Dell ObjectScale, upgrade to version 4.1.0.3 or later for the 4.1.x branch, or migrate from vulnerable 4.2.0.0 to a patched 4.2.x release when available (Dell advisory DSA-2026-143 does not specify 4.2.x fixed version, suggesting 4.2.0.0 users should downgrade to patched 4.1.0.3+ until 4.2.x patch release). Interim mitigations: Implement strict file system permissions on log directories to prevent access by low-privileged users (chmod 700 on log paths, restrict to root/admin accounts only). Rotate all credentials that may have been logged prior to patching, including API tokens, service account passwords, and administrative credentials. Enable log encryption at rest and sanitize existing log archives. Review log aggregation and SIEM configurations to ensure forwarded logs do not expose secrets to broader audiences. Full technical guidance available in Dell Security Advisory DSA-2026-143: https://www.dell.com/support/kbdoc/en-us/000449325/dsa-2026-143-security-update-for-dell-objectscale-prior-to-4-1-0-3-and-4-2-0-0-insertion-of-sensitive-information-into-log-file-vulnerability.