CVE-2026-40636

Use of Hard‑Coded Credentials in Dell ECS and ObjectScale Allows Local File System Access

Published May 11, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for attacker.

Analysis

Technical impact

The vulnerability is due to the use of hard‑coded credentials in Dell ECS and ObjectScale, allowing an unauthenticated attacker who has local access to read or modify the filesystem. This flaw aligns with CWE‑798 and can be leveraged to gain unauthorized local access to system files.

Affected Systems

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions earlier than 4.3.0.0 are affected. These products run on Dell hardware in enterprise storage environments.

Risk and Exploitability

The CVSS score of 9.8 signals a critical risk level, while the EPSS score of less than 1% indicates a very low likelihood of exploitation at present. The vulnerability is not identified in the CISA KEV catalog. Exploitation requires only local presence on the machine; no remote authentication or network access is needed.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Dell

ECS

unaffected

Version	Status	Constraints
`0`	affected	< 4.3.0.0 or later

Dell

ObjectScale

unaffected

Version	Status	Constraints
`0`	affected	< 4.3.0.0 or later

Configuration 1 [-]

OR	cpe:2.3:a:dell:elastic_cloud_storage::::::::
	cpe:2.3:a:dell:objectscale::::::::

No data.

Vendor Product Versions

Dell

Ecs

Version	Status	Scheme	Platform
`[0,4.3.0.0)`	affected	generic	—

Dell

Objectscale

Version	Status	Scheme	Platform
`[0,4.3.0.0)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Dell ECS and ObjectScale to the latest firmware versions that resolve hard‑coded credential usage, following Dell’s security update procedures.
Ensure that the system administration credentials are secured and not embedded in configuration files or code.
If an immediate upgrade is not feasible, restrict local user privileges, isolate the asset from critical data, and monitor file activity for suspicious access.

Generated by OpenCVE AI on May 11, 2026 at 17:41 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.223% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1

History

May 12, 2026 5:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dell elastic Cloud Storage
CPEs		cpe:2.3:a:dell:elastic_cloud_storage:::::::: cpe:2.3:a:dell:objectscale::::::::
Vendors & Products		Dell elastic Cloud Storage

May 12, 2026 10:45 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dell Dell ecs Dell objectscale
Vendors & Products		Dell Dell ecs Dell objectscale

May 11, 2026 6:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		Use of Hard‑Coded Credentials in Dell ECS and ObjectScale Allows Local File System Access

May 11, 2026 3:15 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for attacker.
Weaknesses		CWE-798
References		https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`