CVE-2026-40636 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-40636 | CVSS 9.8 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-40636 is a hard-coded credentials vulnerability affecting Dell Elastic Cloud Storage (ECS) versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, exposing both object storage platforms to unauthorized access by local unauthenticated attackers.

Technical Detail

The flaw involves static, hard-coded credentials embedded within the affected software, which cannot be changed through normal administrative processes and are therefore persistent across deployments. A local unauthenticated attacker who gains access to the system or its configuration artifacts can leverage these credentials to authenticate to privileged components without valid user credentials. Depending on the privilege level associated with the hard-coded account, exploitation could result in full administrative compromise of the storage platform, unauthorized data access, or lateral movement within the storage infrastructure.

Exploitation Status

No known exploit code has been publicly identified or confirmed at this time. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog. Despite the absence of confirmed exploitation, the critical CVSS score of 9.8 and the nature of hard-coded credentials make this a high-priority remediation target, as such flaws are straightforward to exploit once the credentials are identified or disclosed.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence. Organizations operating Dell ECS or ObjectScale in environments with shared or multi-tenant local access should treat this as an elevated risk given the potential for insider threat or post-initial-access abuse.

What To Do

Organizations running Dell ECS versions 3.8.1.0 through 3.8.1.7 should apply the vendor-supplied patch immediately, as all versions in that range are confirmed affected. Dell ObjectScale deployments should be upgraded to version 4.3.0.0 or later. Where patching cannot be completed immediately, restrict local system access to the minimum necessary personnel and audit access logs for anomalous authentication activity against storage management interfaces. Review network segmentation controls to limit lateral movement potential from the storage tier. Monitor Dell's security advisories for updated guidance and confirm patch deployment across all affected nodes in distributed ECS or ObjectScale clusters.