Introduction
Hard-coded credentials in enterprise storage are one of the more straightforward paths to complete system compromise. When that storage is purpose-built for exascale AI workloads, the amount of data at risk grows with it. CVE-2026-40636 affects Dell Elastic Cloud Storage (ECS) and Dell ObjectScale, two enterprise object storage platforms designed for large-scale data collection, generative AI training, and global content delivery. It carries a CVSS score of 9.8.
Both products use an exascale architecture with AI-optimized storage, and organizations use them to hold massive data lakes and content repositories. Because other systems depend on them, a compromise at the storage layer can cascade into the data pipelines, model training workflows, and content delivery systems built on top.
Technical Information
The vulnerability is classified under CWE-798: Use of Hard-Coded Credentials. The affected Dell ECS and ObjectScale software ships with credentials embedded directly in the product, tied to default node users. Because these credentials are static and known, an attacker who gains access to the system can use them.
Dell's advisory says an unauthenticated attacker with local access could exploit this flaw to gain filesystem access. The CVSS vector string Dell published points to something broader:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The Network attack vector (AV:N) suggests that if the management or service interfaces on the storage nodes are exposed to a network, remote exploitation may be possible without strict local physical access. The advisory text says "local access" and the vector says "Network", so account for that gap when you assess exposure in your environment.
The other metrics are just as severe. Attack complexity is Low (AC:L), no privileges are required (PR:N), no user interaction is needed (UI:N), and all three impact categories (Confidentiality, Integrity, Availability) are rated High. By these metrics, the flaw is straightforward to exploit once an attacker can reach the relevant interface.
Successful exploitation gives the attacker complete filesystem access on the storage node. On a platform built for exascale workloads, that means an attacker could:
- Read sensitive stored data across the filesystem
- Modify system configurations on the storage node
- Tamper with stored objects
- Disrupt storage availability
The advisory points to the default node users and their credentials, which are documented in the Dell ObjectScale 4.3.0.0 Security Configuration Guide. No public proof of concept or detailed exploitation path has been published for this vulnerability.
Affected Systems and Versions
| Product | Affected Versions | Remediated Version |
|---|---|---|
| Dell Elastic Cloud Storage (ECS) | Versions 3.8.1.0 through 3.8.1.7 | Version 4.3.0.0 or later |
| Dell ObjectScale | All versions prior to 4.3.0.0 | Version 4.3.0.0 or later |
Both products need an upgrade to version 4.3.0.0 or later to fully resolve the vulnerability. Customers should open an Operating Environment Upgrade Service Request with Dell and reference DSA-2026-019.
Organizations that cannot upgrade right away can use a password change procedure that Dell documents for default node users. It sits under the Default Node Users table in the Dell ObjectScale 4.3.0.0 Security Configuration Guide. Applying the password change on any supported ECS or ObjectScale version mitigates the vulnerability without an immediate system upgrade.
Because the CVSS vector lists a Network attack vector, organizations should also check whether the management or service interfaces on ECS and ObjectScale nodes are exposed to broader network segments. Restricting network access to those interfaces reduces the attack surface while remediation is in progress.
Vendor Security History
Dell runs a dedicated Product Security Incident Response Team (PSIRT) that coordinates the response to and disclosure of security vulnerabilities across its product portfolio. Third-party researchers, including the watchTowr Labs team that reported CVE-2025-36604 (a pre-authentication command injection in Dell UnityVSA), have publicly noted Dell PSIRT's professionalism and responsiveness. That earlier critical flaw in UnityVSA, another Dell storage product, shows that storage infrastructure is still an active area of security research. Organizations should stay current on Dell security advisories.
An earlier advisory, DSA-2026-047, first listed version 4.2.0.0 as the remediated version. The current guidance under DSA-2026-019 requires version 4.3.0.0 or later. Organizations that patched to 4.2.0.0 based on the earlier guidance should verify they are on 4.3.0.0 or later.
References
- NVD Entry for CVE-2026-40636
- DSA-2026-019: Security Update for Dell ECS and ObjectScale Multiple Vulnerabilities
- DSA-2026-047: Earlier Security Update for Dell ECS and ObjectScale
- Dell ObjectScale Product Page
- Dell Supply Chain Resilience (PSIRT Information)
- watchTowr Labs: Dell UnityVSA Pre Auth Command Injection (CVE-2025-36604)
- CISA Known Exploited Vulnerabilities Catalog Update (April 2026)
