CVE-2026-26947
Quick assessment
Affected
Dell ECS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Dell ECS 版本 3.8.1.0 至 3.8.1.7，以及 4.4.0.0 之前的 Dell ObjectScale 版本，存在一个“权限管理不当”漏洞。具备本地访问权限的高权限攻击者可能利用此漏洞，导致权限提升。
Possible ATT&CK Techniques 2 AI
T1134 · Access Token Manipulation T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-26947
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-26947
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-26947
请登录查看更多情报信息。
Other References for CVE-2026-26947 (1)
Same Patch Batch · Dell · 2026-09-16 · 11 CVEs total
| CVE-2026-70416 | 10.0 CRITICAL | Dell ObjectScale 4.4.0前 不可信数据反序列化远程代码执行 |
| CVE-2026-86359 | 8.5 HIGH | Dell Repository Manager 3.5.2前默认权限不当提权 |
| CVE-2026-71180 | 8.2 HIGH | Dell Update Package Framework 26.07.03 前返回值未检查 |
| CVE-2025-43936 | 8.1 HIGH | Dell ObjectScale 4.4.0前认证不当漏洞 |
| CVE-2026-71179 | 7.3 HIGH | Dell Update Package Framework 26.07.03 命令注入 |
| CVE-2026-86358 | 6.5 MEDIUM | Dell Update Package Framework 26.07.03前堆栈缓冲区溢出 |
| CVE-2026-76104 | 5.5 MEDIUM | Dell ObjectScale <4.4.0.0 权限分配错误致DoS |
| CVE-2025-36591 | 4.4 MEDIUM | Dell ECS 3.8.1.x与ObjectScale 4.4.0前弱加密漏洞 |
| CVE-2026-71182 | 3.0 LOW | Dell Update Package Framework 26.07.03前路径遍历漏洞 |
| CVE-2026-71181 | 3.0 LOW | Dell Update Package Framework 26.07.03 前链接跟随漏洞 |
IV. Related Vulnerabilities
Same product: ECS
-
CVE-2026-19613
ECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure v -
CVE-2026-18807
ECS < 4.3.8 - Contributor+ Arbitrary Post Binding and Global -
CVE-2026-14230
ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater B -
CVE-2026-14229
ECS < 4.3.8 - Unauthenticated Private Content Disclosure via -
CVE-2022-31231
Dell ECS 访问控制错误漏洞
Same vendor: Dell
-
CVE-2026-86359
Dell Repository Manager 3.5.2前默认权限不当提权 -
CVE-2026-86358
Dell Update Package Framework 26.07.03前堆栈缓冲区溢出 -
CVE-2026-71182
Dell Update Package Framework 26.07.03前路径遍历漏洞 -
CVE-2026-71181
Dell Update Package Framework 26.07.03 前链接跟随漏洞 -
CVE-2026-71180
Dell Update Package Framework 26.07.03 前返回值未检查
Same weakness: CWE-269
-
CVE-2026-88817
Privilege escalation via legacy access group creation endpoi -
CVE-2026-12793
JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalati -
CVE-2026-55225
Strimzi: Cross-namespace privilege escalation via `Kafka.spe -
CVE-2026-55226
Strimzi: Unrestricted access to all Secrets within namespace -
CVE-2026-65831
ArcadeDB: Privilege escalation via reader role in /api/v1/co
V. Comments for CVE-2026-26947
No comments yet