CVE-2026-22276

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22276", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2026-01-07T07:17:24.536Z", "datePublished": "2026-01-23T09:42:46.521Z", "dateUpdated": "2026-01-23T15:14:02.380Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ObjectScale", "vendor": "Dell", "versions": [{"lessThan": "4.2.0.0", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "datePublic": "2026-01-19T18:30:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure."}], "value": "Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-312", "description": "CWE-312: Cleartext Storage of Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-01-23T09:42:46.521Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000415880/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-23T15:13:51.091500Z", "id": "CVE-2026-22276", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T15:14:02.380Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22276", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-23T15:13:51.091500Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-23T15:13:57.678Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "ObjectScale", "versions": [{"status": "affected", "version": "N/A", "lessThan": "4.2.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-01-19T18:30:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000415880/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.", "supportingMedia": [{"type": "text/html", "value": "Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-312", "description": "CWE-312: Cleartext Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-01-23T09:42:46.521Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22276", "state": "PUBLISHED", "dateUpdated": "2026-01-23T15:14:02.380Z", "dateReserved": "2026-01-07T07:17:24.536Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2026-01-23T09:42:46.521Z", "assignerShortName": "dell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ObjectScale", "vendor": "Dell", "versions": [{"lessThan": "4.2.0.0", "status": "affected", "version": "N/A", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:elastic_cloud_storage:*:*:*:*:*:*:*:*", "matchCriteriaId": "8FFE0BD5-DC60-46D3-9A26-6E82DBB982EC", "versionEndExcluding": "4.2.0.0", "versionStartIncluding": "3.8.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:objectscale:*:*:*:*:*:*:*:*", "matchCriteriaId": "25F884EC-C7A1-4734-8C17-08BFF2046175", "versionEndExcluding": "4.2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure."}, {"lang": "es", "value": "Dell ECS, versiones 3.8.1.0 a 3.8.1.7, y Dell ObjectScale versiones anteriores a 4.2.0.0, contiene una vulnerabilidad de almacenamiento de informaci\u00f3n sensible en texto claro. Un atacante con pocos privilegios con acceso local podr\u00eda, potencialmente, explotar esta vulnerabilidad, lo que llevar\u00eda a la revelaci\u00f3n de informaci\u00f3n."}], "id": "CVE-2026-22276", "lastModified": "2026-06-17T10:19:40.853", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "security_alert@emc.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22276", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-23T15:13:51.091500Z", "version": "2.0.3"}}]}, "published": "2026-01-23T10:15:53.800", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000415880/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T03:10:51.117498+00:00", "value": {"mitigation_remediation": ["Apply the Dell security update DSA\u20112026\u2011047 to upgrade ECS to 3.8.1.8 or later and ObjectScale to 4.2.0.0 or later.", "Restrict local access to privileged accounts and enforce least\u2011privilege principles for any users who can log into the system.", "If an immediate upgrade is not possible, encrypt sensitive data before storage or relocate it to a protected storage layer to mitigate the risk of disclosure."], "summary": {"action": "Apply Patch", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Affected are Dell Elastic Cloud Storage versions 3.8.1.0 through 3.8.1.7 and all Dell ObjectScale deployments older than 4.2.0.0. These products are identified by Dell\u2019s CPE entries for elastics cloud storage and objectscale.", "description_and_impact": "The vulnerability arises from cleartext storage of sensitive data in Dell ECS and ObjectScale. A low\u2011privileged attacker with local access can read data that should be protected, leading to confidential information disclosure. This weakness is classified as CWE\u2011312.", "risk_and_exploitability": "The CVSS v3.1 score of 5.5 indicates moderate severity, while a current EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local, low\u2011privileged access, making it an in\u2011situ risk rather than a remote one; therefore, the overall risk is moderate contingent on the local privilege model."}}}}, "created": "2026-01-26T11:54:48.217670+00:00", "title": "Cleartext Storage of Sensitive Information in Dell ECS and ObjectScale", "updated": "2026-04-18T03:15:35.430235+00:00", "vendors": ["dell", "dell$PRODUCT$ecs_streamer", "dell$PRODUCT$objectscale"]}