Is CVE-2026-28261 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-28261 being exploited in the wild.

How severe is CVE-2026-28261?

High severity, with a CVSS score of 7.8, published 8 April 2026.

Which products and versions are affected?

Dell Elastic Cloud Storage 3.8.1.0 through 3.8.1.7; Dell ObjectScale Prior to 4.1.0.3, 4.2.0.0.

Is there a fix for CVE-2026-28261?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-28261 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-28261?

Check whether you run Dell Elastic Cloud Storage or Dell ObjectScale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-28261: Dell ECS and ObjectScale sensitive information disclosure in logs

CVE-2026-28261 · Severity: high · CVSS 7.8 · Published 2026-04-08

Dell Elastic Cloud Storage and ObjectScale, which provide enterprise-grade cloud storage solutions, are vulnerable to a flaw where sensitive information is recorded in system logs. A user with low-level access to the system could read these logs to discover secrets or credentials. This could allow an attacker to escalate their privileges and gain full control over the storage environment, potentially leading to data theft or service disruption.

Technologies: Dell Elastic Cloud Storage, Dell ObjectScale. Vendors: Dell.

Quick answers

Is CVE-2026-28261 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-28261 being exploited in the wild.
How severe is CVE-2026-28261?: High severity, with a CVSS score of 7.8, published 8 April 2026.
Which products and versions are affected?: Dell Elastic Cloud Storage 3.8.1.0 through 3.8.1.7; Dell ObjectScale Prior to 4.1.0.3, 4.2.0.0.
Is there a fix for CVE-2026-28261?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-28261 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-28261?: Check whether you run Dell Elastic Cloud Storage or Dell ObjectScale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An 'Insertion of Sensitive Information into Log File' vulnerability (CWE-532) exists in Dell Elastic Cloud Storage (ECS) and ObjectScale. The flaw occurs when the software writes sensitive secrets or credentials into plain-text log files accessible to local users. An attacker with low-privileged local access can read these logs to extract credentials, subsequently using them to authenticate as a higher-privileged user or compromise the entire system. The vulnerability is remediated in ECS version 4.2.0.1 and ObjectScale versions 4.1.0.3 and 4.2.0.1.

Affected products

Dell Elastic Cloud Storage (ECS) 3.8.1.0 through 3.8.1.7
Dell ObjectScale Prior to 4.1.0.3, 4.2.0.0

Timeline

2026-04-06: advisory: Initial release of DSA-2026-143
2026-04-08: disclosed: CVE published to NVD
2026-05-07: other: Revised affected versions in vendor advisory

References

https://www.dell.com/support/kbdoc/en-us/000449325/dsa-2026-143-security-update-for-dell-objectscale-prior-to-4-1-0-3-and-4-2-0-0-insertion-of-sensitive-information-into-log-file-vulnerability

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.