# CVE-2026-26946: Dell ECS and ObjectScale privilege escalation in OS

Source: https://junglewise.ai/threats/cve-2026-26946-dell-ecs-and-objectscale-privilege-escalation-in-os  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-26946 · Severity: medium · CVSS 6.7 · Published 2026-05-11

Dell ECS and ObjectScale, which are enterprise-grade storage solutions for managing large-scale data, are affected by a security flaw in their underlying operating system. A user who already has high-level administrative access to the system could exploit this vulnerability to gain even higher privileges. This could allow an attacker to bypass existing security controls and gain full control over the storage environment.

Technologies: [Dell ECS](https://junglewise.ai/threats/technologies/ecs), [Dell ObjectScale](https://junglewise.ai/threats/technologies/objectscale). Vendors: [Dell](https://junglewise.ai/threats/vendors/dell).

## Quick answers

**Is CVE-2026-26946 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-26946 being exploited in the wild.

**How severe is CVE-2026-26946?** Medium severity, with a CVSS score of 6.7, published 11 May 2026.

**Which products and versions are affected?** Dell ECS 3.8.1.0 - 3.8.1.7; Dell ObjectScale Prior to 4.3.0.0.

**Is there a fix for CVE-2026-26946?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-26946 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-26946?** Check whether you run Dell ECS or Dell ObjectScale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper privilege management vulnerability (CWE-269) exists within the operating system layer of Dell ECS and ObjectScale. The flaw allows a high-privileged attacker with local access to the system to escalate their permissions further. The vulnerability is triggered through local access without requiring user interaction. Successful exploitation could lead to a total loss of confidentiality, integrity, and availability for the affected node. Dell has released security updates to address this issue in ECS and ObjectScale 4.3.0.0.

## Affected products

- Dell ECS 3.8.1.0 - 3.8.1.7
- Dell ObjectScale Prior to 4.3.0.0

## Timeline

- 2026-05-11: disclosed
- 2026-05-11: advisory

## References

- [https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1](https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1)

## Related threats

- [Dell ObjectScale incorrect permission assignment in OS](https://junglewise.ai/threats/cve-2026-76104-dell-objectscale-incorrect-permission-assignment-in-os)
- [Dell ObjectScale deserialization of untrusted data vulnerability](https://junglewise.ai/threats/cve-2026-70416-dell-objectscale-deserialization-of-untrusted-data-vulnerability)
- [Dell ECS and ObjectScale privilege escalation via improper privilege management](https://junglewise.ai/threats/cve-2026-26947-dell-ecs-and-objectscale-privilege-escalation-via-improper)
- [Dell ObjectScale improper authentication](https://junglewise.ai/threats/cve-2025-43936-dell-objectscale-improper-authentication)
- [Dell ECS and ObjectScale use of broken cryptographic algorithm](https://junglewise.ai/threats/cve-2025-36591-dell-ecs-and-objectscale-use-of-broken-cryptographic-algorithm)