CVE-2026-22273
Published: 23 January 2026
Summary
CVE-2026-22273 is a high-severity Use of Default Credentials (CWE-1392) vulnerability in Dell Elastic Cloud Storage. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 24.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and IA-5 (Authenticator Management).
Deeper analysis
CVE-2026-22273 is a Use of Default Credentials vulnerability (CWE-1392) affecting the operating system in Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.2.0.0. Published on January 23, 2026, it has a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.
A low-privileged attacker with remote network access can exploit this vulnerability by leveraging the default credentials. Successful exploitation allows elevation of privileges, potentially granting unauthorized control over the affected systems.
Dell Security Advisory DSA-2026-047 provides details on security updates for Dell ECS and ObjectScale to address this and other vulnerabilities; practitioners should consult https://www.dell.com/support/kbdoc/en-us/000415880/dsa-2026-047-security-update-for-dell-ecs-and-objectscale-multiple-vulnerabilities for patching instructions and mitigation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4416
Vulnerability details
Dell ECS, versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.2.0.0, contains an Use of Default Credentials vulnerability in the OS. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Default credentials vulnerability (CWE-1392) with remote network access directly enables use of default accounts for initial access/priv esc and exploitation of a public-facing service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Explicitly requires changing default authenticators prior to first use, directly preventing exploitation of the default credentials vulnerability in the OS.
Mandates management of accounts including disabling unnecessary ones and changing credentials, mitigating the risk of low-privileged attackers exploiting defaults for privilege escalation.
Requires identifying, reporting, and correcting flaws like this CVE through timely patching as per the Dell advisory, eliminating the vulnerability.