PT-2026-39587 · Dell · Objectscale+1

Published 2026-05-10 · Updated 2026-05-11 · CVE-2026-35157

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell ECS versions 3.8.1.0 through 3.8.1.7 Dell ObjectScale versions prior to 4.3.0.0

Description The user interface contains an improper neutralization of formula elements in CSV files. This allows an unauthenticated attacker with remote access to perform CSV Formula Injection, which could potentially lead to remote execution.

Recommendations Update Dell ECS to a version later than 3.8.1.7. Update Dell ObjectScale to version 4.3.0.0 or later.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

BDU:2026-08719

CVE-2026-35157

Affected Products

Ecs

Objectscale

References · 7

• https://dell.com/support/kbdoc/en-us/000462117/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-08719 · Security Note
• https://cve.org/CVERecord?idCVE-2026-35157 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35157 · Security Note
• https://twitter.com/VulmonFeeds/status/2053795273139192175 · Twitter Post
• https://t.me/CVEtracker/53366 · Telegram Post
• https://twitter.com/CVEnew/status/2053954488990302396 · Twitter Post