CVE-2026-70416

Dell ObjectScale versions before 4.4.0.0 have a deserialization of untrusted data flaw allowing remote code execution by unauthenticated attackers.

Dell ObjectScale prior to 4.4.0.0 contains a deserialization of untrusted data vulnerability that permits an unauthenticated remote attacker to execute arbitrary code. This is a critical, actively exploitable flaw that directly violates CMMC/NIST 800-171 requirements for patch management and remote access controls, forcing DIB organizations to immediately upgrade or isolate affected systems to prevent data exfiltration and ransomware deployment.

Shame score — A critical CVSS 10.0 remote code execution flaw in a storage platform was left unpatched long enough to be cataloged as a CVE, indicating negligent patch management and avoidable exposure to active exploitation.