Dell System Update (Product): news timeline & CVEs

Critical Dell System Update Tool Vulnerability Allows Attackers to Execute Code as Root User

Dell patched five System Update flaws, including CVSS 9.6 path traversal that can execute code as root.

Dell advisory DSA-2026-324, published October 1, 2026, covers five flaws in Dell System Update before version 2.3.0.0. CVE-2026-86360 (CVSS 9.6) is a path traversal bug that could let a remote unauthenticated attacker access the filesystem and run code as root, though the CVSS vector requires user interaction. CVE-2026-86361 and CVE-2026-86362 (both 8.2) are local privilege issues; CVE-2026-63697 (7.6) is improper certificate validation and CVE-2026-71168 (7.3) is another path traversal. Dell says 2.3.0.0 or later fixes all five and has not reported active exploitation.

Cyber Security NewsOct 6, 12:57 UTC · 2d agoVulnerability 5 sources CVE-2026-86360 CVE-2026-86361 CVE-2026-86362+2 CVEs1

Dell System Update flaw allows attackers to gain root privileges (CVE-2026-86360)

Dell System Update flaw CVE-2026-86360 can let unauthenticated remote attackers execute code as root.

Dell urged customers to patch CVE-2026-86360, a path-traversal vulnerability in Dell System Update before version 2.3.0.0 with a CVSS base score of 9.6. An unauthenticated remote attacker could gain filesystem access and execute arbitrary code as root, potentially compromising the application and the underlying operating system. DSU applies driver, BIOS, and firmware updates to Dell PowerEdge servers. Dell also fixed CVE-2026-63697 and CVE-2026-71168, which could allow remote execution, and CVE-2026-86361 and CVE-2026-86362, which could allow privilege elevation. The advisory does not say any of the flaws have been exploited in the wild.

Help Net Securityupdated Oct 6, 12:57 UTC · 2d agofirst Oct 6, 10:44 UTC · 2d agoVulnerability 5 sources CVE-2026-86360 CVE-2026-63697 CVE-2026-71168

Dell Urges Customers to Patch Critical DSU Flaw That Can Give Attackers Root Access

Dell urges patching CVE-2026-86360, a CVSS 9.6 path traversal in System Update that can give unauthenticated attackers root on PowerEdge servers.

Dell warned that System Update versions before 2.3.0.0 contain CVE-2026-86360, a path-traversal vulnerability scored CVSS 9.6. An unauthenticated remote attacker could gain filesystem access and execute arbitrary code as root on affected PowerEdge servers. Dell also fixed CVE-2026-86361 and CVE-2026-86362 (both 8.2), CVE-2026-63697 (7.6), and CVE-2026-71168 (7.3), covering local privilege escalation, improper certificate validation, and another path traversal. Customers should upgrade to 2.3.0.0 or later; Dell has not reported active attacks.

Security Affairsupdated Oct 6, 12:57 UTC · 2d agofirst Oct 6, 07:01 UTC · 2d agoVulnerability 5 sources CVE-2026-86360 CVE-2026-86361 CVE-2026-86362

Dell patches 18 critical flaws that could hand attackers the keys to storage and Kubernetes

Dell patched 18 critical CSM and DSU flaws, including two CVSS 10 authentication bypasses, with no known exploitation.

Dell disclosed 18 critical vulnerabilities in Container Storage Modules and Dell System Update that could let attackers bypass authentication, gain root, forge admin tokens, or control storage and Kubernetes clusters. Two flaws, CVE-2026-63688 and CVE-2026-63692, score CVSS 10; others include CVE-2026-67269 (9.9), CVE-2026-54472 (9.8), CVE-2026-6727 (9.6), and path-traversal CVE-2026-86360 (9.6) in DSU. CSM versions before 1.17.0 and DSU before 2.3.0.0 are affected; fixes are CSM 1.18.0 or later and DSU 2.3.0.0 or later, with no workarounds. Dell said it has no evidence of in-the-wild exploitation.

CSO Onlineupdated Oct 6, 12:57 UTC · 2d agofirst Oct 6, 01:25 UTC · 2d agoVulnerability 5 sources CVE-2026-63688 CVE-2026-63692 CVE-2026-67269

New Dell System Update flaw lets hackers gain root privileges

Dell warns a critical System Update path-traversal flaw, CVE-2026-86360, lets unauthenticated attackers run code as root.

Dell warned that CVE-2026-86360, a critical path-traversal flaw in the Dell System Update CLI, lets an unauthenticated remote attacker access the filesystem and execute arbitrary code as root on unpatched systems. The same update fixes high-severity DSU bugs CVE-2026-63697 and CVE-2026-71168 for remote code execution and CVE-2026-86361 and CVE-2026-86362 for privilege escalation; customers should move to DSU 2.3.0.0 or later. Dell also urged immediate patching of maximum-severity Container Storage Modules flaws CVE-2026-63688 and CVE-2026-63692. Dell has not flagged these new issues as actively exploited.

BleepingComputerOct 5, 14:53 UTC · 3d agoVulnerability CVE-2026-86360 CVE-2026-63697 CVE-2026-71168+6 CVEs2

Dell System Update

Timeline5 articles

Related CVEsby mentions

Appears with

Critical Dell System Update Tool Vulnerability Allows Attackers to Execute Code as Root User

Dell System Update flaw allows attackers to gain root privileges (CVE-2026-86360)

Dell Urges Customers to Patch Critical DSU Flaw That Can Give Attackers Root Access

Dell patches 18 critical flaws that could hand attackers the keys to storage and Kubernetes

New Dell System Update flaw lets hackers gain root privileges