UNC6201 (Threat actor): news timeline & CVEs

Related CVEsby mentions

CVE-2026-2276910.013%

Hard-coded credentials in Dell RecoverPoint for Virtual Machines allow root OS access

published Feb 17, 2026· Dell RecoverPoint for Virtual Machines (RP4VMs) KEV

CVE-2021-215517.879%

Local Privilege Escalation in Dell dbutil_2_3.sys Driver

published May 4, 2021· Dell dbutil driver (dbutil_2_3.sys) KEV PoC ×2

CVE-2026-6368810.0—

Unauthenticated Credential Theft in Dell Container Storage Modules (CSM) gRPC Server

published 2d ago· Dell Container Storage Modules (CSM) - csm-authorization-storage gRPC server (CSM Authorization module)

CVE-2026-6369210.0—

Unauthenticated Privilege Escalation in Dell Container Storage Modules (<1.18.0)

published 2d ago· Dell (Dell EMC) Container Storage Modules (CSM)

CVE-2026-614219.8—

Hard-Coded Credentials in Dell Container Storage Modules (CSM) Authorization, pre-1.18.0

published 2d ago· Dell Container Storage Modules (CSM) — CSM Authorization component

CVE-2026-863609.6—

Unauthenticated Path Traversal to Root Code Execution in Dell System Update

published 2d ago· Dell System Update (DSU)

CVE-2026-863628.2—

Local Privilege Escalation to Root in Dell System Update prior to 2.3.0.0

published 2d ago· Dell System Update (DSU)

CVE-2026-863618.2—

Local Privilege Escalation to Root in Dell System Update (DSU) < 2.3.0.0

published 2d ago· Dell System Update (DSU)

CVE-2026-636977.6—

Improper Certificate Validation in Dell System Update Enables Root-Level RCE

published 2d ago· Dell System Update (DSU)

CVE-2026-544727.5—

Hard-Coded Credentials in Dell Container Storage Modules (CSM) csm-docs

published 2d ago· Dell Container Storage Modules (CSM)

New Dell System Update flaw lets hackers gain root privileges

Dell warns a critical System Update path-traversal flaw, CVE-2026-86360, lets unauthenticated attackers run code as root.

Dell warned that CVE-2026-86360, a critical path-traversal flaw in the Dell System Update CLI, lets an unauthenticated remote attacker access the filesystem and execute arbitrary code as root on unpatched systems. The same update fixes high-severity DSU bugs CVE-2026-63697 and CVE-2026-71168 for remote code execution and CVE-2026-86361 and CVE-2026-86362 for privilege escalation; customers should move to DSU 2.3.0.0 or later. Dell also urged immediate patching of maximum-severity Container Storage Modules flaws CVE-2026-63688 and CVE-2026-63692. Dell has not flagged these new issues as actively exploited.

BleepingComputerOct 5, 14:53 UTC · 3d agoVulnerability CVE-2026-86360 CVE-2026-63697 CVE-2026-71168+6 CVEs2

Dell asks admins to patch max severity CSM flaws as soon as possible

Dell patched six critical Container Storage Modules flaws that let unauthenticated attackers gain admin control of enterprise storage.

Dell patched six critical flaws in Container Storage Modules, which link PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT arrays to Kubernetes. CVE-2026-63688 and CVE-2026-63692, both missing-authentication bugs in CSM Authorization, let unauthenticated remote attackers steal storage admin credentials or bypass auth and take full administrative control, including across tenants. Four further flaws allow root on cluster nodes (CVE-2026-67269), admin access to the authorization proxy (CVE-2026-54472), forged admin tokens (CVE-2026-61421), and cluster-wide reads of Kubernetes Secrets (CVE-2026-67273). Dell urges an upgrade to version 1.18.0 or later and has not reported active exploitation of these bugs.

BleepingComputerOct 2, 12:37 UTC · 6d agoVulnerability CVE-2026-63688 CVE-2026-63692 CVE-2026-67269+5 CVEs1

UNC6201

Timeline2 articles

Related CVEsby mentions

Appears with

New Dell System Update flaw lets hackers gain root privileges

Dell asks admins to patch max severity CSM flaws as soon as possible