CVE-2026-35157

Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

CVSS v3 5.8 MEDIUM

5.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dell:elastic_cloud_storage::::::::
	cpe:2.3:a:dell:objectscale::::::::

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Dell ECS 3.8.1.0 a 3.8.1.7 y las versiones de Dell ObjectScale anteriores a la 4.3.0.0, contienen una vulnerabilidad de neutralización inadecuada de elementos de fórmula en un archivo CSV en la interfaz de usuario (UI). Un atacante no autenticado con acceso remoto podría potencialmente explotar esta vulnerabilidad, lo que llevaría a la ejecución remota.

Information

Published : 2026-05-11 10:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-35157

Mitre link : CVE-2026-35157

CVE.ORG link : CVE-2026-35157

JSON object : View

Products Affected

dell

objectscale
elastic_cloud_storage

CWE

CWE-1236

Improper Neutralization of Formula Elements in a CSV File

{"id": "CVE-2026-35157", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35157", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-12T03:55:17.221171Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security_alert@emc.com", "affectedData": [{"vendor": "Dell", "product": "ECS", "versions": [{"status": "affected", "version": "0", "lessThan": "4.3.0.0 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Dell", "product": "ObjectScale", "versions": [{"status": "affected", "version": "0", "lessThan": "4.3.0.0 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-11T10:16:13.490", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-1236"}]}], "descriptions": [{"lang": "en", "value": "Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains an improper neutralization of formula elements in a CSV File vulnerability in the UI. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution."}, {"lang": "es", "value": "Las versiones de Dell ECS 3.8.1.0 a 3.8.1.7 y las versiones de Dell ObjectScale anteriores a la 4.3.0.0, contienen una vulnerabilidad de neutralizaci\u00f3n inadecuada de elementos de f\u00f3rmula en un archivo CSV en la interfaz de usuario (UI). Un atacante no autenticado con acceso remoto podr\u00eda potencialmente explotar esta vulnerabilidad, lo que llevar\u00eda a la ejecuci\u00f3n remota."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:elastic_cloud_storage:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDF94DDF-5A13-493A-B58C-9BBD6C3D38FD", "versionEndExcluding": "4.3.0.0", "versionStartIncluding": "3.8.1.0"}, {"criteria": "cpe:2.3:a:dell:objectscale:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06616353-B83B-49E0-A487-208D0D66FBAF", "versionEndExcluding": "4.3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}