Dell ECS CVE-2026-35157

Exploitation requires that attacker-controlled input submitted through the ECS/ObjectScale UI be subsequently exported into a CSV file and then opened by a victim in a spreadsheet application (e.g. Excel or LibreOffice Calc) that evaluates formula characters. The decisive limiting factors are: (1) a victim must actually export the data and open the resulting CSV - the formula does not execute on the server; (2) many modern spreadsheet applications block formula/DDE execution by default and prompt the user, so the victim typically must approve a security warning; and (3) execution occurs in the context of the workstation opening the file, not the storage platform. The initial injection itself is unauthenticated and remote per the description (PR:N in the supplied vector), but the dangerous execution step depends on the downstream export-and-open workflow.

The official CVSS of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) frames this as a fully remote, unauthenticated, no-interaction remote code execution, but that rating sits uneasily against the underlying weakness. CWE-1236 (improper neutralization of formula elements in a CSV file) is CSV/formula injection: the attacker-supplied data only becomes dangerous when it is exported to a CSV and opened in a spreadsheet application that evaluates the formula - which inherently implies user interaction and execution on the viewer's workstation, not on the ECS/ObjectScale server. The UI:N and 'remote execution' framing therefore appear optimistic; the exported-file open step is user interaction that the official vector omits. The supporting signals all point lower than 9.8: EPSS is 0.11% (30th percentile), SSVC reports Exploitation: none, Automatable: no, and Technical Impact: partial (which itself contradicts the C:H/I:H/A:H triple). No KEV listing and no public exploit were identified. Against that, vuln.today assigns an act_now decision label and the vendor has shipped a fix. Net: treat this as a case where the headline CVSS overstates immediate real-world risk, but because a vendor patch is available and the decision label is act_now, remediation should still be applied promptly rather than deferred. The injection-to-trigger mechanism is not described step-by-step in the available sources beyond the CWE classification.

An unauthenticated remote attacker submits a value beginning with a spreadsheet formula character (e.g. '=', '+', '-', '@') into a field in the ECS/ObjectScale UI that is later included in a CSV export. When an administrator or operator exports that data and opens the CSV in a spreadsheet application that evaluates formulas, the injected formula runs in the context of the victim's workstation. No public exploit code was identified at the time of analysis.