Loading story…
A critical vulnerability, tracked as CVE-2025-46608, has been identified in Dell Data Lakehouse versions prior to 1.6.0.0. This flaw is due to improper access control, allowing a high-privileged attacker with remote access to escalate privileges within the system. The vulnerability is rated as critical with a CVSS score of 9.1, and exploitation could result in unauthorized access, compromise of system integrity, and exposure of customer data. Dell has advised all customers to upgrade to the latest version immediately to mitigate the risk.
Security advisories emphasize the urgency of patching affected systems, as the vulnerability is remotely exploitable and could be leveraged to gain elevated privileges. No specific affected product versions have been listed beyond the general guidance to update any installations prior to version 1.6.0.0. Organizations using Dell Data Lakehouse should prioritize remediation to prevent potential exploitation and data breaches.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
A critical privilege-escalation vulnerability affecting Dell Data Lakehouse was publicly identified as CVE-2025-46608. The available references describe the issue as an elevation-of-privileges flaw but provide no additional technical or remediation details.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dell disclosed two high-severity vulnerabilities in **PowerProtect Data Domain** appliances running multiple **DD OS** releases, including a weak-credentials flaw tracked as `CVE-2026-23853` and a missing-authentication issue tracked as `CVE-2026-26944`. The weak-credentials vulnerability affects Feature Release versions **7.7.1.0 through 8.5**, **LTS2025 8.3.1.0 through 8.3.1.20**, and **LTS2024 7.13.1.0 through 7.13.1.50**, and could allow an unauthenticated attacker with local access to gain unauthorized access to the system. The issue is classified as **CWE-1391** and carries a **CVSS v3.1** score vector of `AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. Dell also reported `CVE-2026-26944`, a **missing authentication for critical function** flaw classified as **CWE-306**, which could allow an unauthenticated remote attacker to execute arbitrary commands with **root privileges** if an authenticated user performs a specific action. That vulnerability is rated with the **CVSS v3.1** vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. Both issues were referenced in Dell security guidance, including advisory **`DSA-2026-060`**, and affect backup infrastructure that may be critical to recovery operations, making remediation and version review a priority for defenders.
Jun 29, 2026
Dell disclosed multiple high-severity vulnerabilities affecting enterprise storage and backup platforms, including **PowerProtect Data Domain**, **Storage Manager**, and **Unity**. In PowerProtect Data Domain, **CVE-2026-26944** allows unauthenticated remote attackers to reach a privileged function and potentially execute commands as `root` if a legitimate user performs a specific action, while **CVE-2026-26943** and **CVE-2026-23778** enable root-level command execution for attackers with high privileges. Dell said the issues affect several DD OS release tracks, Data Domain Virtual Edition, APEX Protection Storage, Data Domain Management Center, and PowerProtect DP Series appliances, and released fixes through advisory **DSA-2026-060**, adding that it had no indication of active exploitation. Dell also issued critical updates for other storage lines. **Dell Storage Manager** vulnerabilities **CVE-2025-43994** and **CVE-2025-43995** expose management functions and APIs to unauthenticated remote access or authentication bypass, potentially affecting all storage arrays managed by a vulnerable instance; Dell’s advisory **DSA-2025-393** recommends upgrading to **2020 R1.22** or later. In **Dell Unity**, **CVE-2025-36604** permits unauthenticated remote OS command injection, while **CVE-2025-36606** and **CVE-2025-36607** allow authenticated attackers to escape restricted utilities and run commands as `root`; Dell remediated those flaws in **Unity OE 5.5.1** and later. The disclosures highlight elevated risk to backup integrity, storage administration, and ransomware recovery operations if exposed management interfaces remain unpatched.
Jun 29, 2026
Dell Technologies disclosed multiple vulnerabilities in **ObjectScale** and **Elastic Cloud Storage (ECS)** through advisory **DSA-2026-393**. The most severe, **CVE-2026-70416**, carries a CVSS score of 10.0 and allows unauthenticated remote code execution through unsafe deserialization of untrusted data in ObjectScale versions earlier than `4.4.0.0`, potentially enabling remote compromise of affected storage systems. The advisory also covers an unauthenticated improper-authentication flaw, local privilege-management and cryptographic weaknesses, an operating-system permission issue that can cause denial of service, and third-party component vulnerabilities. Dell advises organizations to upgrade to **ObjectScale/ECS 4.4.0.0 or later**; `4.2.0.1` is also available for supported affected releases. Until patching is complete, administrators should restrict management interfaces to trusted networks and monitor authentication and configuration activity for signs of abuse.
Sep 18, 2026