Loading story…
Dell Technologies disclosed multiple vulnerabilities in ObjectScale and Elastic Cloud Storage (ECS) through advisory DSA-2026-393. The most severe, CVE-2026-70416, carries a CVSS score of 10.0 and allows unauthenticated remote code execution through unsafe deserialization of untrusted data in ObjectScale versions earlier than 4.4.0.0, potentially enabling remote compromise of affected storage systems.
The advisory also covers an unauthenticated improper-authentication flaw, local privilege-management and cryptographic weaknesses, an operating-system permission issue that can cause denial of service, and third-party component vulnerabilities. Dell advises organizations to upgrade to ObjectScale/ECS 4.4.0.0 or later; 4.2.0.1 is also available for supported affected releases. Until patching is complete, administrators should restrict management interfaces to trusted networks and monitor authentication and configuration activity for signs of abuse.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Dell Technologies issued DSA-2026-393 addressing multiple vulnerabilities in Dell ObjectScale and Elastic Cloud Storage, including CVE-2026-70416, a CVSS 10.0 unauthenticated remote-code-execution flaw in ObjectScale versions earlier than 4.4.0.0. Dell recommended upgrading affected deployments to version 4.4.0.0 or later, or 4.2.0.1 for supported affected releases, and limiting management interfaces to trusted networks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dell disclosed multiple high-severity vulnerabilities affecting enterprise storage and backup platforms, including **PowerProtect Data Domain**, **Storage Manager**, and **Unity**. In PowerProtect Data Domain, **CVE-2026-26944** allows unauthenticated remote attackers to reach a privileged function and potentially execute commands as `root` if a legitimate user performs a specific action, while **CVE-2026-26943** and **CVE-2026-23778** enable root-level command execution for attackers with high privileges. Dell said the issues affect several DD OS release tracks, Data Domain Virtual Edition, APEX Protection Storage, Data Domain Management Center, and PowerProtect DP Series appliances, and released fixes through advisory **DSA-2026-060**, adding that it had no indication of active exploitation. Dell also issued critical updates for other storage lines. **Dell Storage Manager** vulnerabilities **CVE-2025-43994** and **CVE-2025-43995** expose management functions and APIs to unauthenticated remote access or authentication bypass, potentially affecting all storage arrays managed by a vulnerable instance; Dell’s advisory **DSA-2025-393** recommends upgrading to **2020 R1.22** or later. In **Dell Unity**, **CVE-2025-36604** permits unauthenticated remote OS command injection, while **CVE-2025-36606** and **CVE-2025-36607** allow authenticated attackers to escape restricted utilities and run commands as `root`; Dell remediated those flaws in **Unity OE 5.5.1** and later. The disclosures highlight elevated risk to backup integrity, storage administration, and ransomware recovery operations if exposed management interfaces remain unpatched.
Jun 29, 2026
Dell disclosed two high-severity vulnerabilities in **PowerProtect Data Domain** appliances running multiple **DD OS** releases, including a weak-credentials flaw tracked as `CVE-2026-23853` and a missing-authentication issue tracked as `CVE-2026-26944`. The weak-credentials vulnerability affects Feature Release versions **7.7.1.0 through 8.5**, **LTS2025 8.3.1.0 through 8.3.1.20**, and **LTS2024 7.13.1.0 through 7.13.1.50**, and could allow an unauthenticated attacker with local access to gain unauthorized access to the system. The issue is classified as **CWE-1391** and carries a **CVSS v3.1** score vector of `AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. Dell also reported `CVE-2026-26944`, a **missing authentication for critical function** flaw classified as **CWE-306**, which could allow an unauthenticated remote attacker to execute arbitrary commands with **root privileges** if an authenticated user performs a specific action. That vulnerability is rated with the **CVSS v3.1** vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. Both issues were referenced in Dell security guidance, including advisory **`DSA-2026-060`**, and affect backup infrastructure that may be critical to recovery operations, making remediation and version review a priority for defenders.
Jun 29, 2026
Dell Storage Manager was found to contain multiple critical vulnerabilities, including CVE-2025-43995 (CVSS 9.8), which allows unauthenticated attackers to bypass authentication and access APIs exposed by the `ApiProxy.war` component in the DataCollectorEar.ear package. Exploitation is possible by using a special `SessionKey` and `UserId` associated with special users created for internal service purposes. Another related vulnerability, CVE-2025-43994 (CVSS 8.6), involves missing authentication for critical functions, potentially leading to information disclosure if exploited by a remote attacker. These flaws affect Dell Storage Center systems running Dell Storage Manager version 20.1.21. The vulnerabilities were disclosed by security researchers and confirmed by Dell, with advisories urging immediate patching to prevent unauthorized access and data exposure. No evidence of exploitation in the wild has been reported as of the publication date, but the critical nature of the flaws underscores the need for urgent remediation in affected environments.
Jun 29, 2026