Dell ECS

CVE-2026-22273 — Use of Default Credentials in ECS 3.8.1.0–3.8.1.7 and ObjectScale <4.2.0.0. Per the NVD entry for CVE-2026-22273, Dell ECS versions 3.8.1.0 through 3.8.1.7 and ObjectScale prior to 4.2.0.0 ship with a Use-of-Default-Credentials vulnerability. The attack vector is network-based with low complexity, enabling privilege escalation. Remediation requires upgrade to patched versions. Organizations running Dell ECS or ObjectScale should audit deployment versions immediately; the default-credentials class of bug is among the highest-priority categories for any internet-reachable storage tier.

A second, more severe Dell security advisory landed in May 2026 — DSA-2026-019 patches a CVSS 9.8 hard-coded-credentials flaw plus three more ECS/ObjectScale bugs. CVE-2026-40636 (hard-coded credentials) headlines four fixed issues, alongside an OS privilege-escalation bug, CSV formula injection in the management UI, and an authentication bypass in Geo replication. Affected: ECS 3.8.1.0–3.8.1.7, ObjectScale prior to 4.3.0.0; fixed in ObjectScale 4.3.0.0+. Per Dell ECS and ObjectScale Multiple Vulnerabilities.

The same January 2026 advisory (DSA-2026-047) that fixed the default-credentials bug also patched a cleartext-syslog disclosure flaw. CVE-2026-22274: ECS's Fabric Syslog component transmits authentication events and system configs unencrypted, letting a network-positioned attacker passively intercept or manipulate the data. Remediated alongside CVE-2026-22273 in ObjectScale 4.2.0.0+. Per CVE-2026-22274: Dell ECS Information Disclosure Flaw.

ObjectScale is a full Kubernetes-native rebuild of the ECS codebase, not a rename. Dell now ships two options on the same trusted codebase — ECS for traditional workloads, ObjectScale as a container/microservices architecture on Kubernetes for cloud-native workloads — spanning hardware from EX500 and EX5000 through EXF900 and the newer XF960. Per Dell ECS / ObjectScale - Product Review.

ObjectScale 4.1 plus the XF960 all-flash appliance brought a large throughput jump alongside modern security features. XF960 delivers up to 300% more read throughput and 42% more write throughput than the previous-gen EXF900, with 75% lower read and 42% lower write response times. ObjectScale 4.1 adds multiple compression modes (LZ4, Zstandard, Deflate, Snappy), TLS 1.3, self-encrypting drives, push-based event notifications, and S3FS support; upgrades are supported from ECS 3.8.x/4.0.x. Per ECS - ObjectScale 4.1 and XF960 Platform Announcement.