Dell System Update flaw could give attackers root access

Dell has urged customers to update its System Update (DSU) command-line deployment tool after disclosing a critical vulnerability that could let an unauthenticated attacker with remote access run code with root privileges on affected systems.

Tracked as CVE-2026-86360, the flaw stems from a path traversal weakness. Dell said successful exploitation could allow filesystem access and complete compromise of the vulnerable application and underlying operating system. DSU helps enterprise IT administrators deploy BIOS, firmware, and software updates on Linux and Windows systems running on PowerEdge server infrastructure.

Dell recommends updating DSU to version 2.3.0.0 or later, which fixes the vulnerability. The company also patched four high-severity DSU flaws: CVE-2026-63697 and CVE-2026-71168 could allow remote code execution, while CVE-2026-86361 and CVE-2026-86362 could enable privilege escalation.

Dell has not flagged these flaws as actively exploited. The company also urged administrators to patch two maximum-severity Container Storage Modules vulnerabilities, CVE-2026-63688 and CVE-2026-63692. BleepingComputer reported that state-backed hacking groups have exploited other Dell vulnerabilities in past attacks, including flaws in the Dell dbutil driver and Dell RecoverPoint for Virtual Machines.