What is the CVSS score of CVE-2026-40636?

CVE-2026-40636 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Dell ECS are affected by CVE-2026-40636?

Dell ECS versions 3.8.1.0 through 3.8.1.7 and ObjectScale below 4.3.0.0 contain hard-coded credentials that enable unauthorized filesystem access to storage infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-40636?

Within 24 hours: Identify all systems running Dell ECS 3.8.1.0-3.8.1.7 or ObjectScale <4.3.0.0 using asset inventory; restrict local system access to storage nodes via network segmentation and IAM controls. Within 7 days: Prioritize upgrade to Dell ECS 3.8.1.8 or later, or ObjectScale 4.3.0.0 or later per Dell advisory DSA-2026-047; coordinate with storage teams for maintenance windows. Within 30 days: Complete patching of all affected systems; conduct access logs audit for unauthorized filesystem activity; validate hard-coded credentials are no longer accessible post-upgrade.

Dell ECS CVE-2026-40636

EUVD-2026-29046 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-05-11 dell

GHSA-mw27-v6r3-mmpp

Authentication Bypass Dell

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 11, 2026 - 11:01 EUVD

Analysis Generated

May 11, 2026 - 10:31 vuln.today

CVE Published

May 11, 2026 - 08:57 nvd

CRITICAL 9.8

DescriptionCVE.org

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for attacker.

AnalysisAI

Hard-coded credentials in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale <4.3.0.0 allow unauthenticated filesystem access. Despite CVSS 9.8 (network vector), the description explicitly states 'local access' is required, creating a critical discrepancy between scoring and actual attack surface. Attackers with local system access can leverage embedded credentials to gain unauthorized filesystem access. No active exploitation (CISA KEV) or public exploit confirmed at time of analysis. Dell advisory DSA-2026-047 addresses the vulnerability.

Technical ContextAI

Dell ECS (Elastic Cloud Storage) and ObjectScale are enterprise object storage platforms designed for unstructured data at scale, commonly deployed in data center and cloud environments. This vulnerability involves CWE-798 (Use of Hard-coded Credentials), where authentication secrets are embedded directly in application code, configuration files, or binaries rather than using secure credential management. The affected CPE strings identify Dell ECS versions in the 3.8.1.x branch (specifically 3.8.1.0 through 3.8.1.7) and all ObjectScale versions prior to 4.3.0.0. Hard-coded credentials in storage infrastructure are particularly dangerous as they provide direct access to the underlying filesystem layer, bypassing application-level access controls and potentially exposing customer data, system configurations, and cryptographic materials stored on the platform.

RemediationAI

Upgrade Dell ECS to version 3.8.1.8 or later, and Dell ObjectScale to version 4.3.0.0 or later per Dell Security Advisory DSA-2026-047 (https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1). The advisory explicitly addresses this hard-coded credential vulnerability along with other security issues. Until patching is complete, implement compensating controls based on actual attack vector: if local access is genuinely required, restrict physical and logical access to storage nodes through bastion hosts, require MFA for administrative SSH access, disable direct console access where feasible, and monitor for anomalous filesystem access patterns in storage node logs. If network vector is confirmed by Dell, immediately isolate management interfaces behind firewall rules permitting only authorized administrator IP ranges, implement network segmentation separating storage management networks from general infrastructure, and deploy intrusion detection signatures for authentication attempts using default or known credentials. Note that compensating controls do NOT eliminate the hard-coded credential - the embedded secret remains exploitable until patched, so these are temporary risk reduction measures only.