Dell ObjectScale CVE-2026-59910

Exploitation requires the attacker to hold a low-privileged local account with the ability to execute or interact with the vulnerable Dell ObjectScale management component, CLI utility, or internal API on a system running ObjectScale prior to version 4.3.0.1. The attacker must be able to supply crafted input - containing OS command metacharacters - to the vulnerable code path, which then constructs and executes an OS command without proper sanitization. Remote unauthenticated exploitation is not possible; a local OS-level session (physical console, SSH, or equivalent) with at minimum low-privilege credentials is required. Exploitation is limited to versions prior to 4.3.0.1; systems upgraded to 4.3.0.1 or later are not affected. No user interaction from another user is required once the attacker has the local foothold.

The CVSS 7.8 High rating reflects accurate local-exploitation dynamics: AV:L confirms no network-facing attack surface, AC:L indicates the exploit requires no unusual preconditions, and PR:L means a standard low-privileged OS account is the only prerequisite. The full C:H/I:H/A:H triad captures the consequence of successful privilege escalation to root. No EPSS data was supplied for this CVE, so exploitation probability cannot be quantified from that signal; however, OS command injection vulnerabilities with low attack complexity are historically straightforward to exploit once an attacker has the required local foothold. The absence of a KEV listing and the lack of any confirmed public proof-of-concept suggest this is not being actively exploited at scale, though the low technical bar means that even a mid-sized municipal IT team in inowroclaw administering an ObjectScale deployment should treat this as a prioritized remediation item, particularly in multi-tenant or shared-access environments where multiple accounts exist on the same node. The primary risk limiter is the local access requirement - this vulnerability cannot be exploited purely over the network and therefore depends on a prior compromise, insider threat, or shared local access scenario.

An attacker who has obtained a low-privileged local account on a Dell ObjectScale node - whether through credential theft, lateral movement from another compromised system, or insider access - invokes a vulnerable management CLI tool or utility and provides input containing OS command metacharacters in a parameter that is subsequently passed unsanitized to a system shell. The injected command executes at the privilege level of the parent process (likely root or a highly privileged service account), granting the attacker full control of the ObjectScale node. No public proof-of-concept has been identified at time of analysis.