EUVD-2026-80837Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated remote deserialization RCE gives AV:N/AC:L/PR:N/UI:N with full C/I/A; I assess S:U (base 9.8) since no evidence supports the vendor's scope change beyond the affected component.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
3DescriptionCVE.org
Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
AnalysisAI
Unauthenticated remote code execution in Dell ObjectScale affects all versions prior to 4.4.0.0, where deserialization of untrusted data (CWE-502) can let a network-reachable attacker execute arbitrary code on the appliance. Both the vendor/NVD vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and our independent assessment score the issue 10.0, reflecting low-complexity, pre-auth exploitation with full confidentiality, integrity, and availability impact and no user interaction; the practical limiting factor is exposure, since instances not reachable from the attacker's position are not exploitable. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions per the CVSS vector - remote, unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against Dell ObjectScale instances prior to 4.4.0.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a maximum-severity issue with strongly aligned signals: the vendor/NVD CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (base 10.0) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, full CIA impact, and a scope change - the classic profile of a pre-auth deserialization RCE (CWE-502). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Dell ObjectScale to version 4.4.0.0 or later, which the vendor confirms resolves this issue per Dell DSA-2026-393 (https://www.dell.com/support/kbdoc/en-in/000505935/dsa-2026-393-security-update-for-dell-objectscale-multiple-vulnerabilities); because this DSA bundles multiple fixes, apply the complete update rather than a partial one and confirm the resulting build number after the upgrade. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Dell ObjectScale deployments and identify any running versions prior to 4.4.0.0, prioritize internet-facing or partner-reachable instances, and either upgrade them to ObjectScale 4.4.0.0 or temporarily isolate/restrict network access to trusted management networks while verifying no unauthorized access has occurred. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Objectscale
View allPrivilege escalation in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale prior to 4.2.0.0 stems from hardcoded default credentia
Improper authentication in Dell ObjectScale versions prior to 4.4.0.0 allows remote, unauthenticated attackers to bypass
OS Command Injection in Dell ObjectScale versions prior to 4.3.0.1 enables a low-privileged local attacker to inject arb
OS command injection in Dell ObjectScale versions prior to 4.3.0.1 allows a local low-privileged attacker to escalate pr
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 7.5).
OS command injection in Dell ObjectScale (versions prior to 4.3.0.1) enables a low-privileged local attacker to execute
Privilege escalation in Dell ObjectScale versions prior to 4.3.0.1 is enabled by an Uncontrolled Search Path Element (CW
Path traversal in Dell ObjectScale (versions prior to 4.3.0.1) enables a local low-privileged attacker to write to or co
Local privilege escalation in Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 allows an attacker
Elastic Cloud Storage versions up to 3.8.1.7 is affected by cleartext transmission of sensitive information (CVSS 6.5).
Dell ObjectScale versions prior to 4.3.0.1 expose sensitive information through insecure logging in the svc_tools compon
Local privilege escalation in Dell Elastic Cloud Storage (≤3.8.1.7) and ObjectScale (<4.1.0.3, =4.2.0.0) allows authenti
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today