Dell ObjectScale CVE-2026-56090

Exploitation requires all three of the following conditions to be met simultaneously: (1) a local account on the affected ObjectScale host with at least low-level OS privileges, as confirmed by the AV:L and PR:L CVSS metrics; (2) write access to at least one directory that appears in the application's search path (PATH, LD_LIBRARY_PATH, or equivalent) ahead of the legitimate binary or library location; and (3) user interaction - a privileged user or service must execute the operation that triggers the vulnerable path resolution, as confirmed by the UI:R CVSS metric. Remote exploitation without a prior local foothold is not possible given AV:L. No scope change occurs (S:U), so elevated impact is confined to the compromised host. Non-default or misconfigured filesystem permissions that allow low-privileged users to write to system-level directories would materially increase exploitability.

The CVSS 7.3 High score is driven by full C/I/A impact, but the practical attack surface is substantially narrowed by two key constraints: local access (AV:L) and required user interaction (UI:R), meaning the attacker must already have a foothold on the host and must also engineer a situation in which a privileged process triggers the vulnerable path lookup. EPSS data is not provided in the available intelligence, so statistical exploitation likelihood cannot be quantified. No CISA KEV listing exists and no public proof-of-concept has been identified, indicating no confirmed active exploitation at time of analysis. Applying the SSVC framework: exploitation status is none, the attack is not automatable due to the local-access and user-interaction prerequisites, and technical impact is total - yielding a medium-urgency patch priority for most enterprise environments. That said, even a mid-sized municipal IT team in swidnica operating ObjectScale nodes on-premises should treat this as an urgent remediation item, since privilege escalation in a storage platform directly enables lateral movement and data exfiltration. The tags reference 'Information Disclosure,' which may hint at secondary impact from the elevated access gained, but the primary mechanism confirmed by the CWE and CVSS is privilege escalation.

An attacker with a low-privileged local account on an ObjectScale node identifies a directory writable by their account that appears earlier in the system's executable or library search path than the legitimate ObjectScale binary location. The attacker places a malicious shared library or executable with the same name as a component invoked by a privileged ObjectScale process. When a privileged user or automated service trigger the affected operation - satisfying the required user interaction condition - the application resolves and loads the attacker's file instead of the legitimate one, executing arbitrary code with elevated privileges. No public exploit code has been identified at time of analysis.