External risk intelligence

Dell ObjectScale Improper Authentication Leading to Unauthorized Access

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-43936

Dell ObjectScale is an object storage platform designed to be accessed over the network. As an object storage gateway or service endpoint, it is commonly deployed to handle remote requests, making the interface reachable and often exposed to networks where unauthorized access attempts can occur.

Authentication Bypass

Dell Objectscale

before 4.4.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Dell ObjectScale software has a critical security flaw that could allow unauthorized access to the system. This vulnerability, if exploited by an attacker with remote access and no authentication, could lead to unauthorized access to the system. The primary concern is to confirm if your organization is using this specific software and if it is exposed to potential threats.

Unauthenticated remote access to Dell ObjectScale.
Critical flaw could allow unauthorized system access.
Confirm relevance and exposure of this software.

Attack Path

How an attacker could exploit the issue

An attacker could reach the Dell ObjectScale system from anywhere on the network and bypass authentication checks. This would allow them to gain unauthorized access to the system's resources.

Remote, unauthenticated access is required.
The vulnerability is triggered by the improper authentication mechanism.
Results in unauthorized system access.

Live Threat

Current exploitation, exposure, and threat context

This Improper Authentication vulnerability in Dell ObjectScale could allow an unauthenticated remote attacker to gain unauthorized access when supported by the advisory. This means that sensitive information or system controls within the ObjectScale environment might be compromised.

System data could be accessed.
Remote unauthenticated access could exploit it.
Unauthorized access to the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Dell ObjectScale platform, specifically versions prior to 4.4.0.0, presents a critical remote authentication vulnerability. This issue likely falls under the purview of infrastructure or platform teams responsible for the ObjectScale deployment, with coordination potentially needed from security and network teams to assess external reachability and impact. The immediate first step is to inventory all ObjectScale instances, confirm their network exposure, and identify the business-criticality and accountable owner for each.

Ownership: Infrastructure or platform teams.
Verify: Network exposure and business criticality.
Action: Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Dell ObjectScale?

Dell ObjectScale is an enterprise-grade, software-defined object storage platform. It enables organizations to store and manage massive amounts of unstructured data, providing a scalable service layer that typically acts as a gateway or endpoint for applications to interact with data over a network.

What does an Improper Authentication vulnerability mean for CVE-2025-43936?

This flaw, classified as CWE-287, means the software fails to correctly verify the identity of a user or system attempting to connect. Because the mechanism responsible for checking credentials is bypassed, the system cannot distinguish between legitimate users and unauthorized actors, granting access without valid proof of identity.

How does an attacker trigger this vulnerability?

An attacker triggers this issue by sending requests over a network directly to the vulnerable ObjectScale service. No pre-existing account, password, or session is needed. The vulnerability is not triggered by internal administrative actions or authenticated user activity; it relies entirely on the system's failure to gatekeep initial remote connection attempts.

Why should I care about this vulnerability based on Halo Surface Signal?

Halo Surface Signal identifies this as a critical concern because ObjectScale is designed to provide network-accessible storage. Since these endpoints are often placed where they can receive remote requests, they may be reachable from broader network segments, increasing the probability that an unauthorized actor can reach the service interface.

What is the first step for teams managing affected ObjectScale versions?

Begin by creating an inventory of all deployed ObjectScale instances to identify which are running versions prior to 4.4.0.0. Once identified, evaluate the network placement of these instances to determine their accessibility, and then prioritize update planning for any systems that have broader network visibility or handle sensitive data.

References

www.dell.com/support/kbdoc/en-in/000505935/dsa-2026-393-security-u…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.