# CVE-2026-40636: Dell ECS and ObjectScale hard-coded credentials

Source: https://junglewise.ai/threats/cve-2026-40636-dell-ecs-and-objectscale-hard-coded-credentials  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-11. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-40636 · Severity: critical · CVSS 9.8 · Published 2026-05-11

Dell ECS and ObjectScale storage solutions contain a security flaw where fixed, pre-programmed login credentials are used. An attacker could use these credentials to gain unauthorized access to the system's underlying file system. This could allow them to view, modify, or delete sensitive stored data, potentially leading to a total compromise of the storage environment.

Technologies: [Dell ECS](https://junglewise.ai/threats/technologies/ecs), [Dell ObjectScale](https://junglewise.ai/threats/technologies/objectscale). Vendors: [Dell](https://junglewise.ai/threats/vendors/dell).

## Quick answers

**Is CVE-2026-40636 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40636 being exploited in the wild.

**How severe is CVE-2026-40636?** Critical severity, with a CVSS score of 9.8, published 11 May 2026.

**Which products and versions are affected?** Dell ECS 3.8.1.0 - 3.8.1.7; Dell ObjectScale Prior to 4.3.0.0.

**Is there a fix for CVE-2026-40636?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40636 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40636?** Check whether you run Dell ECS or Dell ObjectScale at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Dell ECS (versions 3.8.1.0 through 3.8.1.7) and Dell ObjectScale (prior to 4.3.0.0) utilize hard-coded credentials (CWE-798). While the advisory text mentions 'local access' in the description, the provided CVSS 3.1 vector (AV:N) indicates the vulnerability is network-exploitable. An unauthenticated attacker can leverage these static credentials to gain unauthorized access to the underlying operating system's filesystem. This can result in full compromise of data confidentiality, integrity, and availability. Dell has released updates to address this issue in ECS and ObjectScale 4.3.0.0.

## Affected products

- Dell ECS 3.8.1.0 - 3.8.1.7
- Dell ObjectScale Prior to 4.3.0.0

## Timeline

- 2026-05-11: advisory: Initial publication of DSA-2026-019 and CVE-2026-40636

## References

- [https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1](https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1)

## Related threats

- [Dell ObjectScale incorrect permission assignment in OS](https://junglewise.ai/threats/cve-2026-76104-dell-objectscale-incorrect-permission-assignment-in-os)
- [Dell ObjectScale deserialization of untrusted data vulnerability](https://junglewise.ai/threats/cve-2026-70416-dell-objectscale-deserialization-of-untrusted-data-vulnerability)
- [Dell ECS and ObjectScale privilege escalation via improper privilege management](https://junglewise.ai/threats/cve-2026-26947-dell-ecs-and-objectscale-privilege-escalation-via-improper)
- [Dell ObjectScale improper authentication](https://junglewise.ai/threats/cve-2025-43936-dell-objectscale-improper-authentication)
- [Dell ECS and ObjectScale use of broken cryptographic algorithm](https://junglewise.ai/threats/cve-2025-36591-dell-ecs-and-objectscale-use-of-broken-cryptographic-algorithm)