Dell ObjectScale CVE-2026-56685

Exploitation requires all three of the following conditions to be met simultaneously: (1) The attacker must have low-privilege local access to the Dell ObjectScale system - remote-only network access is insufficient, as the attack vector is strictly local (AV:L per CVSS); (2) The attacker must hold at least low-level credentials on the system (PR:L per CVSS) - unauthenticated exploitation is not possible; (3) User interaction from another user on the system must be triggered (UI:R per CVSS) - the attack is not self-sufficient and depends on a second actor performing some action, such as opening a file, viewing a log, or using an administrative interface. The local-only vector (AV:L) is the primary limiting factor for external attackers, as it requires prior system compromise or insider access. The mandatory user interaction requirement (UI:R) further limits fully automated or opportunistic exploitation. Dell ObjectScale must be running a version prior to 4.3.0.1 for the vulnerability to be present.

The CVSS 3.1 score of 7.3 (High) reflects full C/I/A impact offset by a local attack vector (AV:L), low complexity (AC:L), low-privilege requirement (PR:L), and mandatory user interaction (UI:R). These constraints substantially reduce real-world risk compared to a network-accessible, unauthenticated vulnerability with the same impact metrics. The local-only vector means an attacker must already have a foothold on the ObjectScale node - this is a privilege-escalation or lateral-movement primitive rather than an initial-access vector. The UI:R flag introduces a social-engineering dependency, further complicating opportunistic exploitation. No EPSS data was provided, so probabilistic exploitation likelihood cannot be quantified. The vulnerability is absent from CISA KEV, and no POC has been identified, indicating no confirmed or widespread active exploitation at this time. For organizations with strict internal access controls and limited local account exposure on storage nodes, this is a lower operational priority; for environments with shared or broadly scoped local access to ObjectScale systems, it warrants prompt patching.

An attacker with a low-privilege local account on a Dell ObjectScale node (e.g., a monitoring service account or storage operator account) crafts malicious input containing shell metacharacters targeting an application function that processes input via an OS command. The attacker then induces a higher-privileged local user - such as an administrator using a management utility or reviewing a log - to interact with the malicious content, triggering command execution under the application's runtime context. Successful exploitation results in arbitrary command execution on the ObjectScale node, potentially enabling data exfiltration, persistence establishment, or disruption of object storage services.