CVE-2026-35157 is a medium severity CSV formula injection in the Dell ECS and ObjectScale user interface. NVD scores it 5.8. Update as directed in Dell advisory DSA-2026-047. For ObjectScale the record points to version 4.3.0.0 or later. Treat exported CSV files with care until the update is in place.
What's affected
Dell ECS 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions before 4.3.0.0.
The record does not give a fixed ECS version. Read Dell security advisory DSA-2026-047 for the remediation for ECS and for the other issues in the same advisory.
How to check if you're exposed
Check your ECS or ObjectScale version in the product's management interface and compare it with the ranges above. Then read DSA-2026-047 and note the update path for your release.
What to do now
- Open DSA-2026-047 and find the fixed ECS release and the ObjectScale update.
- Plan the update with your storage team, since these are infrastructure systems.
- Until then, tell staff to treat CSV files exported from the UI with care and to open them in a viewer that does not evaluate formulas.
- Review the other vulnerabilities listed in the same Dell advisory.
Why it matters
The weakness is CWE-1236, improper neutralization of formula elements in a CSV file. When a system writes user controlled text into a CSV, cells that begin with characters such as an equals sign can be treated as formulas by a spreadsheet. The spreadsheet then runs what the cell says.
The record notes it needs user interaction and has high attack complexity, which explains the medium rating. The usual fix is to prefix risky cells so spreadsheets treat them as text.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Formula injection is a client side problem that starts on the server. The system stores text from users, then writes it into a file that a spreadsheet will interpret. Teams that export reports from storage consoles and open them in Excel or a similar tool are the people at risk. A short note to those staff costs nothing while the update is scheduled.
Quick check
Is opening a CSV in a text editor safe?
A plain text editor does not evaluate formulas, so it avoids the issue. Spreadsheet applications are where it matters.
Sources
Last reviewed: 19 October 2026.
