CVE-2025-36591: Dell ECS Information Disclosure Vulnerability

CVE-2025-36591 Overview

CVE-2025-36591 affects Dell ECS and Dell ObjectScale, two enterprise object storage platforms. The vulnerability stems from the use of a broken or risky cryptographic algorithm [CWE-327]. A high-privileged attacker with local access to an affected system can exploit the weak cryptographic implementation to expose sensitive information. Dell published the issue through security advisory DSA-2026-393 and released fixed builds for both product lines. The flaw does not permit remote exploitation, code execution, or data tampering, but it does undermine the confidentiality guarantees expected from an enterprise object storage platform.

Critical Impact
A local high-privileged attacker can leverage the weak cryptographic algorithm to recover or infer protected data, leading to information exposure on affected Dell ECS and ObjectScale deployments.

Affected Products

Dell ECS versions 3.8.1.0 through 3.8.1.7
Dell ObjectScale versions prior to 4.4.0.0
Deployments relying on the affected cryptographic component for data-at-rest or in-transit protection

Discovery Timeline

2026-09-16 - CVE-2025-36591 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2025-36591

Vulnerability Analysis

The vulnerability is categorized under [CWE-327: Use of a Broken or Risky Cryptographic Algorithm]. Dell ECS and ObjectScale implement cryptographic operations that rely on an algorithm no longer considered secure by modern standards. When a high-privileged local actor interacts with the affected component, the weakness allows recovery of protected material or inference of secrets that the algorithm was meant to shield.

Because the attack vector is local and requires high privileges, exploitation presumes an operator, administrator, or a compromised service account already present on the storage node. The impact is confined to confidentiality: integrity and availability of the object store are not directly affected. The scope remains unchanged, meaning the attacker gains information within the same security boundary rather than pivoting across trust zones.

Root Cause

The root cause is the continued use of a cryptographic primitive or configuration that fails to meet current strength requirements. Weak algorithms, insufficient key sizes, or deprecated modes of operation allow an attacker with sufficient access to reverse, brute force, or otherwise derive sensitive plaintext or key material from ciphertext observable on the local system.

Attack Vector

Exploitation requires local access with high privileges to a Dell ECS or ObjectScale node. The attacker interacts with the affected component to obtain cryptographically protected artifacts, then applies analysis appropriate to the weak algorithm to recover the underlying information. No user interaction is required. Refer to Dell Security Update DSA-2026-393 for vendor-specific technical context.

Detection Methods for CVE-2025-36591

Indicators of Compromise

Unexpected access to key material, credential stores, or cryptographic configuration files on Dell ECS or ObjectScale nodes
Local shell activity or administrative API calls from accounts that do not typically perform cryptographic operations
Presence of Dell ECS versions 3.8.1.0 through 3.8.1.7 or Dell ObjectScale versions below 4.4.0.0 in asset inventory

Detection Strategies

Inventory all Dell ECS and ObjectScale nodes and correlate installed versions against the fixed releases listed in DSA-2026-393
Monitor administrative and privileged sessions on storage nodes for access to cryptographic modules or key files
Alert on unusual reads of encrypted objects or metadata that could indicate offline analysis of weakly protected data

Monitoring Recommendations

Forward Dell ECS and ObjectScale audit logs to a centralized SIEM or data lake and baseline privileged activity
Track process execution and file access on storage nodes with endpoint telemetry to identify abuse of high-privileged accounts
Review authentication events for administrative accounts and enforce alerting on off-hours or anomalous logins

How to Mitigate CVE-2025-36591

Immediate Actions Required

Identify all Dell ECS deployments in the 3.8.1.0 through 3.8.1.7 range and Dell ObjectScale deployments below 4.4.0.0
Apply the vendor-provided fixes referenced in DSA-2026-393 at the earliest supported maintenance window
Restrict local and administrative access to storage nodes to a minimal set of authorized operators
Rotate credentials, keys, and secrets that may have been protected by the affected algorithm after patching

Patch Information

Dell has published fixed versions through advisory Dell Security Update DSA-2026-393. Upgrade Dell ECS to a release beyond 3.8.1.7 as directed by the advisory and upgrade Dell ObjectScale to version 4.4.0.0 or later.

Workarounds

Limit high-privileged local access using role-based access control and just-in-time administration until patches are applied
Enable enhanced auditing on cryptographic operations and privileged sessions to detect exploitation attempts
Isolate management interfaces of Dell ECS and ObjectScale nodes on a dedicated administrative network segment

bash

# Configuration example
# Verify installed Dell ECS or ObjectScale version and compare against fixed releases
# Replace <node> with the target management endpoint
ssh admin@<node> "svc_version show"

# Restrict local privileged access on storage nodes
sudo usermod -L <unused_admin_account>
sudo chage -E 0 <unused_admin_account>

# Enable auditd rules for cryptographic key material access
sudo auditctl -w /etc/ssl/private -p rwxa -k crypto_key_access
sudo auditctl -w /var/lib/objectscale/keys -p rwxa -k objectscale_key_access