Dell ObjectScale CVE-2026-59909

Exploitation requires local access to a system running Dell ObjectScale (AV:L per CVSS) and a low-privileged local account (PR:L per CVSS) - for example, a standard OS user, a restricted service account, or any account capable of interacting with the vulnerable ObjectScale component locally. No user interaction from a victim is required (UI:N). No special non-default configuration is identified in the description as a prerequisite. Factors that limit exploitation include the requirement for physical or remote shell access to the ObjectScale host itself; remote unauthenticated exploitation is not possible based on the local attack vector. Environments that restrict local interactive logins to administrative accounts only significantly reduce exploitability.

The CVSS 7.1 score reflects a locally exploitable flaw with low access complexity and low privilege requirements, translating to meaningful risk within environments where multiple users or services share the same ObjectScale node. The local attack vector (AV:L) is the primary risk limiter: exploitation cannot be performed remotely without first gaining a foothold, making this most relevant in insider-threat or post-breach lateral-movement scenarios. No EPSS data was provided in the input; without it, exploitation probability cannot be quantified probabilistically. No KEV listing exists, and no POC has been identified, so there is no signal of active exploitation at this time. The I:H and A:H impacts are significant - file tampering at this level could corrupt object metadata, disable storage services, or enable privilege escalation depending on which files are reachable via traversal. Overall, this is a real but bounded risk: high priority for multi-tenant or shared-access ObjectScale deployments, lower urgency for tightly access-controlled single-tenant nodes.

An attacker with a low-privileged local account on a Dell ObjectScale node - such as a shared service account, a restricted shell user, or an account obtained through credential theft - submits a crafted input containing path traversal sequences (e.g., '../../etc/') to a vulnerable file operation within the ObjectScale software. The traversal bypasses the intended directory scope, allowing the attacker to overwrite or corrupt critical configuration or data files, potentially disrupting object storage services or creating a persistent tampered state.