Dell ObjectScale & iDRAC: 8 Vulnerabilities Including High-Severity Command Injection Disclosed Together
Key findings • Dell ObjectScale and iDRAC products affected by 8 vulnerabilities disclosed on August 17, 2026. • Multiple High severity OS Command Injection and Path Traversal flaws in Object…
Key findings
- Dell ObjectScale and iDRAC products affected by 8 vulnerabilities disclosed on August 17, 2026.
- Multiple High severity OS Command Injection and Path Traversal flaws in ObjectScale versions prior to 4.3.0.1.
- Vulnerabilities could lead to privilege escalation, command execution, and information tampering.
- Dell has released patches: ObjectScale 4.3.0.1, iDRAC9 7.20.30.50, and iDRAC10 1.20.60.50.
- A low-privileged local attacker is the primary threat actor for most ObjectScale vulnerabilities.
On August 17, 2026, Dell disclosed a batch of eight vulnerabilities affecting its ObjectScale and iDRAC products. The vulnerabilities, disclosed within a one-hour window, include several high-severity flaws that could allow local attackers to gain elevated privileges or execute commands.
The majority of the disclosed vulnerabilities impact Dell ObjectScale versions prior to 4.3.0.1. Among these, CVE-2026-59910 and CVE-2026-56686 are rated as High severity (CVSSv3 7.8) and involve OS Command Injection, potentially leading to privilege escalation. CVE-2026-56685, also rated High (CVSSv3 7.3), is another OS Command Injection vulnerability, but could result in command execution. CVE-2026-59909, a High severity Path Traversal vulnerability (CVSSv3 7.1), could allow an attacker to tamper with information. CVE-2026-56090, a High severity Uncontrolled Search Path Element vulnerability (CVSSv3 7.3), also poses a risk of privilege escalation.
Lower severity vulnerabilities were also part of this disclosure. CVE-2026-59911, a Medium severity (CVSSv3 5.5) Insertion of Sensitive Information into Log File vulnerability in ObjectScale, could lead to information disclosure. Similarly, CVE-2026-56089, a Low severity Path Traversal vulnerability (CVSSv3 3.3), and CVE-2026-70412, a Low severity Remanent Data Readable after Memory Erase vulnerability affecting both Dell iDRAC9 (prior to 7.20.30.50) and iDRAC10 (prior to 1.20.60.50), could result in information disclosure. All these vulnerabilities require a low-privileged attacker with local or remote access, depending on the specific flaw.
Dell has addressed these vulnerabilities with the release of ObjectScale version 4.3.0.1. For iDRAC, versions 7.20.30.50 for iDRAC9 and 1.20.60.50 for iDRAC10 are recommended. Users of Dell ObjectScale and iDRAC are advised to update to the patched versions to mitigate the risks associated with these vulnerabilities. The clustered disclosure suggests a coordinated release from Dell's security team, highlighting the importance of timely patching for these enterprise systems.
The concentration of high-severity command injection and path traversal vulnerabilities in ObjectScale underscores the critical need for prompt security updates. Attackers with local access could leverage these flaws to gain significant control over affected systems. The iDRAC vulnerabilities, while lower in severity, also present an information disclosure risk that should not be overlooked. Organizations utilizing Dell's ObjectScale and iDRAC products should prioritize applying the available patches to protect their infrastructure.