Ecs
Monthly
CSV formula injection in Dell ECS 3.8.1.0 through 3.8.1.7 and in Dell ObjectScale versions prior to 4.3.0.0 allows remote, unauthenticated attackers to plant spreadsheet formula payloads through input submitted to the storage platform UI, which are then written into an exported CSV and evaluated when a victim opens that file in a spreadsheet application such as Excel or LibreOffice Calc. The vendor's published 9.8 base score assumes no user interaction, but the assessed vector (UI:R, scope changed) makes clear that execution happens on the workstation that opens the exported file, not on the ECS/ObjectScale server, so real-world impact depends on the export-and-open workflow and on whether the spreadsheet application prompts for or blocks formula evaluation. Dell has released a fix in the DSA-2026-047 advisory; EPSS is 0.11% (30th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, although the vuln.today decision label is act_now because the injection step itself is unauthenticated and remotely reachable.
Hard-coded credentials in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale <4.3.0.0 allow unauthenticated filesystem access. Despite CVSS 9.8 (network vector), the description explicitly states 'local access' is required, creating a critical discrepancy between scoring and actual attack surface. Attackers with local system access can leverage embedded credentials to gain unauthorized filesystem access. No active exploitation (CISA KEV) or public exploit confirmed at time of analysis. Dell advisory DSA-2026-047 addresses the vulnerability.
Local privilege escalation in Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 allows an attacker with existing high-privileged local access to elevate privileges. The flaw stems from improper privilege management (CWE-269) and requires authenticated local access (PR:H/AV:L); it is not remotely exploitable. No public exploit code or active exploitation has been identified, and vendor patches are available.
Missing authorization checks in the ECS WordPress plugin before 4.3.10 allow any contributor-level or higher user to read custom field values and post metadata from WordPress posts they do not own, including private and draft content. The plugin's dynamic repeater data source feature accepts user-supplied post identifiers without validating ownership or post publication status, exposing potentially sensitive metadata to lower-privileged authenticated users. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation activity and no CISA KEV listing has been issued.
Broken access control in the Identity and Access Management (IAM) module of Dell ECS (Elastic Cloud Storage) 3.5 and 3.6 lets a remote, unauthenticated attacker read data they should not be able to reach. The flaw exposes confidential object/storage data without granting write or availability impact, and it is fixed in maintenance releases 3.5.1.7 and 3.6.2.4. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), consistent with CISA SSVC scoring exploitation as 'none'.
Improper privilege management in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale prior to 4.3.0.0 allows high-privileged local attackers to escalate privileges and gain full system access, affecting confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at the time of analysis.
Authentication bypass in Dell ECS Geo replication (versions 3.8.1.0-3.8.1.7) and Dell ObjectScale (prior to 4.3.0.0) allows unauthenticated remote attackers to access data in transit by exploiting assumed-immutable data assumptions. The vulnerability affects the replication authentication mechanism, enabling unauthorized data exposure without requiring valid credentials or user interaction.
CSV formula injection in Dell ECS 3.8.1.0 through 3.8.1.7 and in Dell ObjectScale versions prior to 4.3.0.0 allows remote, unauthenticated attackers to plant spreadsheet formula payloads through input submitted to the storage platform UI, which are then written into an exported CSV and evaluated when a victim opens that file in a spreadsheet application such as Excel or LibreOffice Calc. The vendor's published 9.8 base score assumes no user interaction, but the assessed vector (UI:R, scope changed) makes clear that execution happens on the workstation that opens the exported file, not on the ECS/ObjectScale server, so real-world impact depends on the export-and-open workflow and on whether the spreadsheet application prompts for or blocks formula evaluation. Dell has released a fix in the DSA-2026-047 advisory; EPSS is 0.11% (30th percentile), there is no CISA KEV listing, and no public exploit was identified at time of analysis, although the vuln.today decision label is act_now because the injection step itself is unauthenticated and remotely reachable.
Hard-coded credentials in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale <4.3.0.0 allow unauthenticated filesystem access. Despite CVSS 9.8 (network vector), the description explicitly states 'local access' is required, creating a critical discrepancy between scoring and actual attack surface. Attackers with local system access can leverage embedded credentials to gain unauthorized filesystem access. No active exploitation (CISA KEV) or public exploit confirmed at time of analysis. Dell advisory DSA-2026-047 addresses the vulnerability.
Local privilege escalation in Dell ECS 3.8.1.0 through 3.8.1.7 and Dell ObjectScale prior to 4.4.0.0 allows an attacker with existing high-privileged local access to elevate privileges. The flaw stems from improper privilege management (CWE-269) and requires authenticated local access (PR:H/AV:L); it is not remotely exploitable. No public exploit code or active exploitation has been identified, and vendor patches are available.
Missing authorization checks in the ECS WordPress plugin before 4.3.10 allow any contributor-level or higher user to read custom field values and post metadata from WordPress posts they do not own, including private and draft content. The plugin's dynamic repeater data source feature accepts user-supplied post identifiers without validating ownership or post publication status, exposing potentially sensitive metadata to lower-privileged authenticated users. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation activity and no CISA KEV listing has been issued.
Broken access control in the Identity and Access Management (IAM) module of Dell ECS (Elastic Cloud Storage) 3.5 and 3.6 lets a remote, unauthenticated attacker read data they should not be able to reach. The flaw exposes confidential object/storage data without granting write or availability impact, and it is fixed in maintenance releases 3.5.1.7 and 3.6.2.4. There is no public exploit identified at time of analysis and EPSS is very low (0.03%), consistent with CISA SSVC scoring exploitation as 'none'.
Improper privilege management in Dell ECS 3.8.1.0-3.8.1.7 and ObjectScale prior to 4.3.0.0 allows high-privileged local attackers to escalate privileges and gain full system access, affecting confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at the time of analysis.
Authentication bypass in Dell ECS Geo replication (versions 3.8.1.0-3.8.1.7) and Dell ObjectScale (prior to 4.3.0.0) allows unauthenticated remote attackers to access data in transit by exploiting assumed-immutable data assumptions. The vulnerability affects the replication authentication mechanism, enabling unauthorized data exposure without requiring valid credentials or user interaction.