What is the CVSS score of EUVD-2026-29045?

EUVD-2026-29045 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-29045?

Yes, a patch is available for EUVD-2026-29045. Update the affected software to the latest version immediately.

Dell ECS and ObjectScale EUVD-2026-29045

| CVE-2026-35157 MEDIUM

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2026-05-11 dell

GHSA-vm5f-653c-mwv3

Dell Information Disclosure

5.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

May 11, 2026 - 11:01 EUVD

Analysis Generated

May 11, 2026 - 10:32 vuln.today

CVE Published

May 11, 2026 - 09:33 nvd

MEDIUM 5.8

DescriptionCVE.org

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

AnalysisAI

Remote code execution in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale prior to 4.3.0.0 via improper neutralization of formula elements in CSV files processed by the UI. Unauthenticated remote attackers can exploit this vulnerability with user interaction (formula injection attack) to achieve remote execution with limited confidentiality, integrity, and availability impact. No active exploitation confirmed; exploitation requires victim interaction with malicious CSV content.

Technical ContextAI

Dell ECS (Elastic Cloud Storage) and ObjectScale are enterprise storage management platforms. The vulnerability stems from CWE-1236 (Improper Neutralization of Formula Elements in a CSV File), a formula injection attack vector where user-supplied CSV data is not properly sanitized before being processed by the UI. When a CSV file containing formula syntax (such as '=cmd|' or similar payloads) is imported or displayed, the application may interpret these formulas as executable code rather than literal text. This is a classic spreadsheet/CSV processing flaw where the boundary between data and code is not properly enforced. The affected products use CPE identifiers cpe:2.3:a:dell:ecs and cpe:2.3:a:dell:objectscale, indicating impact across both product lines and multiple versions.

RemediationAI

For Dell ECS: upgrade to a patched version released after 3.8.1.7 (exact patched version not specified in available data; consult Dell advisory DSA-2026-047). For Dell ObjectScale: upgrade to version 4.3.0.0 or later. As a temporary workaround pending patching, disable or restrict CSV import functionality in the UI if operationally feasible, or implement file upload validation to reject CSV files containing formula syntax (cells beginning with '=', '+', '@', or '-'). If users must work with CSV files, configure security policies to prevent automatic formula execution in spreadsheet applications and educate users to disable formula evaluation when opening untrusted CSV imports. Note that blocking formula syntax may impact legitimate data import workflows; coordinate this control with operational teams and test in non-production environments first. The vendor advisory (DSA-2026-047) should be consulted for official patched versions and any additional compensating controls or configuration hardening recommendations.