Dell has patched a critical path traversal vulnerability in Dell System Update, the tool enterprise administrators use to deploy firmware and software updates to PowerEdge servers, BleepingComputer reported Monday. Dell says an unauthenticated attacker could exploit the flaw to run code with root privileges, and it is urging customers to upgrade to version 2.3.0.0 or later.

What Happened

The flaw, tracked as CVE-2026-86360, affects Dell System Update (DSU) versions before 2.3.0.0. Help Net Security reported that it carries a CVSS base score of 9.6. According to Dell's advisory, a remote attacker who has not logged in could use the bug to execute arbitrary code as root, compromising both the DSU application and the underlying operating system.

The same update fixes four high-severity DSU vulnerabilities. Two of them, CVE-2026-63697 and CVE-2026-71168, can lead to remote code execution. The other two, CVE-2026-86361 and CVE-2026-86362, allow privilege escalation.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

Dell has not reported any exploitation of the flaws. It said customers should upgrade "at the earliest opportunity."

Why It Matters

DSU is a command-line utility for pushing BIOS, firmware, driver and software updates to Dell PowerEdge servers, typically across many machines at once. Tools of this kind run with high privileges by design, because they need to modify low-level components. A flaw that hands an unauthenticated attacker root access on that kind of tool gives an intruder full control of the server and a potential foothold for moving to other systems.

Path traversal bugs, which let an attacker reach files or directories outside those an application is meant to touch, are a well-understood class of weakness. BleepingComputer noted that the FBI and the Cybersecurity and Infrastructure Security Agency have urged software makers since May 2024 to eliminate such flaws before shipping products, saying they have been described as unforgivable since at least 2007.

Dell products have drawn state-backed attackers before. North Korea's Lazarus group exploited an access control flaw in a Dell driver, CVE-2021-21551, to deploy a Windows rootkit. In February, Mandiant and Google Threat Intelligence Group said suspected Chinese cyberspies tracked as UNC6201 had been exploiting a hardcoded-credential vulnerability, CVE-2026-22769, in Dell RecoverPoint for Virtual Machines since at least mid-2024.

Context

The DSU advisory adds to a busy stretch of Dell security fixes. BleepingComputer reported that Dell also urged administrators to patch two maximum-severity vulnerabilities in its Container Storage Modules, CVE-2026-63688 and CVE-2026-63692. Those were among the six maximum-severity Container Storage Modules flaws The Primary Wire reported Friday, which could let attackers seize storage credentials or gain root on Kubernetes nodes.

What to Watch

The immediate step for PowerEdge operators is to inventory where DSU is installed and update it to 2.3.0.0 or later. Dell's advisory does not report attacks, but the publication of technical details or proof-of-concept code would raise the risk quickly for unpatched systems.

Security teams should also watch whether CISA adds any of the DSU flaws to its Known Exploited Vulnerabilities catalog, which would signal confirmed attacks and set patch deadlines for U.S. federal agencies.