CVE-2026-40636 Hardcoded credentials in ECS
An unauthenticated local attacker can exploit hard-coded credentials to gain filesystem access on Dell ECS and ObjectScale systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40636?
CVE-2026-40636 is a critical vulnerability in Dell ECS, published on 11 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0, contains a use of hard-coded credentials vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to filesystem access for attacker.
Weakness: CWE-798
Which versions are affected by CVE-2026-40636?
It affects 2 products.
Products include Dell Elastic Cloud Storage, Dell Objectscale.
How do I fix CVE-2026-40636?
No fix has been published for CVE-2026-40636 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-40636 being exploited?
There is no known exploitation of CVE-2026-40636 in the wild and no public exploit code.
Other vulnerabilities in Dell ECS
- CVE-2017-8021 EMC Elastic Cloud Storage (ECS) before 3.1 is affected by an undocumented account vulnerability that could potentially be leveraged by malic
- CVE-2026-22273 Hardcoded credentials in ObjectScale
- CVE-2025-26476 Hardcoded credentials in ECS
- CVE-2024-51540 Integer overflow in ECS
- CVE-2026-28261 Information disclosure in Elastic Cloud Storage
Sources
Also known as GHSA-mw27-v6r3-mmpp.