Dell has released fixes for a critical Dell System Update flaw that could let unauthenticated remote attackers execute code with root privileges. The company urges customers to upgrade promptly, warning that successful exploitation could compromise the application and its underlying operating system.
The vulnerability, tracked as CVE-2026-86360, affects Dell System Update (DSU), a command-line deployment tool for enterprise administrators. DSU supports BIOS, firmware and software updates across Windows and Linux systems in PowerEdge server environments.
Path Traversal Weakness Could Enable Full Compromise
According to Dell’s advisory, the critical vulnerability involves path traversal. This type of weakness can allow access to files or directories outside an application’s intended boundaries.
In this case, Dell says an unauthenticated attacker with remote access could exploit the flaw to access the filesystem. Furthermore, the vulnerability could enable arbitrary code execution with root privileges.
That level of access could give an attacker extensive control over the affected system. Consequently, the potential impact extends beyond interference with the update tool itself.
However, Dell has not flagged the vulnerability as actively exploited. The advisory describes the risk of exploitation rather than confirming attacks against customers.
Update Addresses Five DSU Vulnerabilities
Alongside the critical Dell System Update flaw, the company fixed four high-severity vulnerabilities in the same tool.
Two flaws, CVE-2026-63697 and CVE-2026-71168, could allow remote attackers to execute code. Meanwhile, CVE-2026-86361 and CVE-2026-86362 could enable privilege escalation.
Dell recommends upgrading DSU to version 2.3.0.0 or later, which addresses all five vulnerabilities.
Administrators should therefore prioritize checking their deployed DSU versions and installing the corrected release. The update applies to the management tool used to distribute server updates, making it an important part of infrastructure maintenance.
Separate Storage Module Fixes Add to Patch Workload
Dell also issued an urgent patch recommendation for two maximum-severity vulnerabilities in its Container Storage Modules.
Those flaws, CVE-2026-63688 and CVE-2026-63692, affect a separate product. As a result, administrators who use both products need to review the relevant updates independently.
Dell has not identified active exploitation of these storage module vulnerabilities or the newly patched DSU flaws.
Nevertheless, previous attacks involving other Dell products underline why organizations should address serious vulnerabilities promptly.
Earlier Attacks Involved Different Dell Products
The North Korean Lazarus group previously exploited CVE-2021-21551, an access-control vulnerability in Dell’s dbutil driver. Attackers used that weakness in operations involving a Windows rootkit.
Separately, researchers disclosed attacks involving Dell RecoverPoint for Virtual Machines in February. They attributed the activity to UNC6201, a suspected Chinese cyberespionage group.
According to those findings, the group had exploited a hardcoded-credential vulnerability, CVE-2026-22769, since at least mid-2024. The attackers created hidden network interfaces on VMware ESXi servers and deployed malware.
Following that disclosure, CISA gave US federal agencies three days to patch affected systems.
Those incidents involved different vulnerabilities and do not establish exploitation of the new DSU issues. For the current flaws, Dell’s stated remediation is to install System Update version 2.3.0.0 or later.
0 responses to “Critical Dell System Update Flaw Could Give Attackers Root Access”