Dell ObjectScale CVE-2026-56686

Exploitation requires an existing low-privileged local account on a Dell ObjectScale node running a version prior to 4.3.0.1, combined with the ability to invoke the vulnerable component - such as a local CLI tool or administrative interface - and supply user-controlled input. The local attack vector (AV:L) means the vulnerability cannot be exploited remotely without first establishing a foothold on the host through a separate vector. No special non-default configuration is indicated as a prerequisite; any standard deployment of affected versions where a local low-privilege account exists is potentially vulnerable. Exploitation is limited by the requirement for local access, ruling out unauthenticated remote or internet-facing attack scenarios, and by the CVSS PR:L requirement confirming that some form of authenticated local session is necessary.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8 High, capturing that while a local foothold is required, exploitation is low-complexity, needs no user interaction, and yields complete node compromise through privilege escalation. Even a mid-sized municipal IT team in walbrzych running ObjectScale for government data archiving should treat this as urgent given that insider threat actors or any attacker who has already achieved initial access via another vector could leverage this flaw to gain root-level control. No EPSS probability data was included in the source intelligence, so quantitative exploitation likelihood cannot be stated with precision. The vulnerability is not currently listed in the CISA KEV catalog, and no POC code has been identified, both of which modestly reduce near-term automated exploitation risk. The local-only attack vector structurally prevents mass internet-facing exploitation, but post-compromise privilege escalation chains are a standard attacker technique that makes this flaw a meaningful priority in any ObjectScale deployment.

An attacker who holds a low-privileged local account on an ObjectScale node running a version prior to 4.3.0.1 invokes the vulnerable CLI or local administrative interface, supplying input that embeds OS metacharacters such as a semicolons or command substitution expressions. The ObjectScale component passes this input to a system shell without sanitization, causing the injected command to execute in a higher-privilege context and granting the attacker elevated or root-level control of the node. No public proof-of-concept code has been identified at time of analysis, though CWE-78 exploitation techniques are broadly documented and require no specialized tooling.