CVE-2026-70416 is a critical (CVSS 10.0) unsafe deserialization flaw in Dell ObjectScale versions before 4.4.0.0. An unauthenticated remote attacker could potentially reach remote code execution. The fix is to move to 4.4.0.0 or later, as described in Dell security advisory DSA-2026-393.
What's affected
Dell ObjectScale, all versions prior to 4.4.0.0, per the record. The version 4.4.0.0 is the first one the record treats as outside the range.
The Dell advisory is DSA-2026-393, titled as a security update for ObjectScale covering multiple vulnerabilities. Dell's site refused my automated request, so I could not read it. Open it in a browser to confirm the exact fixed release and any other issues it covers.
How to check if you're exposed
In the ObjectScale management interface, look up the software version of each cluster. If it is lower than 4.4.0.0, you are in scope.
Also check who can reach the management and service endpoints. The vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, so network reach with no login is all it takes. Review firewall rules for ObjectScale management networks.
What to do now
- Find every ObjectScale deployment and read its version.
- Read Dell advisory DSA-2026-393 and confirm the fixed release for your platform.
- Plan and run the upgrade to 4.4.0.0 or later.
- Until then, limit network access to ObjectScale interfaces to trusted management hosts.
- Review logs on those systems for unexpected activity around the time the advisory was published, 16 September 2026.
Why it matters
The weakness is CWE-502, deserialization of untrusted data. Applications often turn stored or transmitted objects back into live ones. If the data comes from an untrusted source and the format allows it to name what to build, the attacker gets to influence which code runs.
Storage platforms hold data many other systems depend on, and a flaw with no login and a changed scope can reach well beyond the one service. The record's KEV flag is false and it does not describe exploitation.
Quick check
Which version fixes CVE-2026-70416?
The record says versions prior to 4.4.0.0 are affected, so 4.4.0.0 or later. Confirm in Dell advisory DSA-2026-393.
Sources
Last reviewed: 19 October 2026.
