Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Dell patches critical System Update flaw that can yield root

3 sources · 3 articlesFirst reported Updated ()5 · 2 reads
What's new

First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Dell urges updating System Update to 2.3.0.0 to fix CVE-2026-86360, a CVSS 9.6 path traversal that can execute code as root.

Dell warned that System Update versions before 2.3.0.0 contain five flaws, led by CVE-2026-86360, a path traversal scored CVSS 9.6 that could let an attacker access the filesystem and run arbitrary code as root on PowerEdge servers. Security Affairs and Help Net Security describe the attacker as unauthenticated and remote, while Cyber Security News says the CVSS vector requires user interaction. The release also fixes CVE-2026-86361 and CVE-2026-86362 (both 8.2), which two reports call local privilege issues, plus CVE-2026-63697 (7.6) and CVE-2026-71168 (7.3); those sources identify them as improper certificate validation and another path traversal, whereas Help Net Security groups them as remote-execution flaws. Dell System Update applies driver, BIOS, and firmware updates, and customers should upgrade to 2.3.0.0 or later under advisory DSA-2026-324, dated October 1, 2026. None of the reports say the flaws have been exploited in the wild.

Key facts
  • CVE-2026-86360 is a CVSS 9.6 path traversal in Dell System Update before 2.3.0.0 that can allow filesystem access and arbitrary code execution as root.
  • Two reports describe an unauthenticated remote attacker; Cyber Security News says the CVSS vector also requires user interaction.
  • The same release fixes CVE-2026-86361 and CVE-2026-86362 (both 8.2, local privilege escalation), CVE-2026-63697 (7.6, improper certificate validation), and CVE-2026-71168 (7.3, path traversal); Help Net Security instead calls the latter…
  • Cyber Security News cites Dell advisory DSA-2026-324, published October 1, 2026.
  • Dell System Update applies driver, BIOS, and firmware updates on PowerEdge servers; the fix is version 2.3.0.0 or later.
  • Dell has not reported active exploitation of any of the five flaws.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
CVEs
CVE-2026-86360CVE-2026-86361CVE-2026-86362CVE-2026-63697CVE-2026-71168
Vendors
Dell
Products
Dell System UpdatePowerEdgeDell PowerEdge
Organizations
Dell

Coverage

oldest first · one row per article · UTC
  1. · 25d ago Security AffairsFirst report

    Dell Urges Customers to Patch Critical DSU Flaw That Can Give Attackers Root Access

    Dell urges patching CVE-2026-86360, a CVSS 9.6 path traversal in System Update that can give unauthenticated attackers root on PowerEdge servers.

  2. · 24d ago Help Net Security

    Dell System Update flaw allows attackers to gain root privileges (CVE-2026-86360)

    Dell System Update flaw CVE-2026-86360 can let unauthenticated remote attackers execute code as root.

  3. · 24d ago Cyber Security News

    Critical Dell System Update Tool Vulnerability Allows Attackers to Execute Code as Root User

    Dell patched five System Update flaws, including CVSS 9.6 path traversal that can execute code as root.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-86360
+4 related CVEs
CVE-2026-86361CVE-2026-86362CVE-2026-71168CVE-2026-63697
Unauthenticated Path Traversal to Root Code Execution in Dell System Update
9.6
group max
—