Reported by 4 outlets
Dell System Update flaw lets hackers gain root privileges
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 4.90 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.01 / 0.6 · time to second source
- Recency
- × 0.01 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.1 / 10 = base × recency + community
Desk analysis
Dell has patched CVE-2026-86360, a path traversal flaw in the Dell System Update (DSU) CLI deployment tool, rated CVSS 9.6. DSU pushes BIOS, firmware, and software updates to PowerEdge servers running Linux and Windows. According to Dell's advisory DSA-2026-324, published October 1, 2026, an unauthenticated remote attacker can exploit the flaw for arbitrary code execution with root privileges, giving full compromise of the application and the underlying operating system. All five DSU vulnerabilities in the advisory affect versions prior to 2.3.0.0.
The same advisory covers four high-severity companion flaws: CVE-2026-63697 and CVE-2026-71168 for remote code execution, and CVE-2026-86361 and CVE-2026-86362 for privilege escalation. Dell credits Ori Gabriel with reporting CVE-2026-63697 and CVE-2026-86360, saltedfish with CVE-2026-86361 and CVE-2026-86362, and Nir Yehoshua of Cipher Security Labs with CVE-2026-71168. The fix is DSU 2.3.0.0 or later.
The significance is structural. DSU runs with high privilege on exactly the servers it maintains, so a root-level flaw in the updater turns a patching tool into a fleet-wide entry point. CISA and the FBI have pressed vendors since May 2024 to eliminate path traversal bugs before shipping, calling them unforgivable since at least 2007, and this is another instance of the class persisting in enterprise tooling.
Watch for evidence of in-the-wild exploitation and for scans targeting DSU endpoints. Organizations running PowerEdge estates should inventory where DSU 2.3.0.0 is deployed, prioritize internet-reachable instances, and treat updater tools in general as critical-patch surface rather than background utilities.
Timeline
-
original reporting
Dell System Update flaw lets hackers gain root privileges
bleepingcomputer.com · 8d ago · October 5th, 2026
Dell warned customers to patch a critical vulnerability in the System Update (DSU) command-line interface (CLI) deployment tool as soon as possible. DSU lets enterprise IT administrators deploy BIOS, firmware, and software updates onto Linux and Windows systems on PowerEdge enterprise server infrastructure. In a Thursday security advisory, the company said the flaw (tracked as CVE-2026-86360) allows threat actors to execute code with root privileges on unpatched devices by exploiting a path traversal weakness. "An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for [an] attacker," the company Dell said . "This vulnerability is considered critical because it can be leveraged by an unauthenticated attacker to execute arbitrary code with root privileges. Successful exploitation may allow complete compromise of the vulnerable application and underlying operating system." The FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have urged software companies since May 2024 to remove path traversal weaknesses from their products before shipping, saying such security issues "have been called 'unforgivable' since at least 2007." Dell also patched four high-severity Dell System Update security flaws on Thursday, two that remote attackers can exploit to gain remote code execution (CVE-2026-63697 and CVE-2026-71168) and two more that can be abused for privilege escalation (CVE-2026-86361 and CVE-20
-
update from dell.com
DSA-2026-324: Security update for Dell System Update (DSU) Vulnerabilities
dell.com · 12d ago · October 1st, 2026
Dell's advisory DSA-2026-324, published October 1, 2026, covers five DSU vulnerabilities, all affecting DSU versions prior to 2.3.0.0. The advisory credits Ori Gabriel with reporting CVE-2026-63697 and CVE-2026-86360, saltedfish with CVE-2026-86361 and CVE-2026-86362, and Nir Yehoshua of Cipher Security Labs with CVE-2026-71168, and directs customers to upgrade to DSU 2.3.0.0 or later.
-
mentioned by deafnews.it
Critical 9.6 CVSS flaw in Dell System Update allows unauthenticated remote root access to PowerEdge servers. Dell urges immediate patching t
deafnews.it · 8d ago · October 5th, 2026
-
update from www.bleepingcomputer.com
A flaw in Dell System Update allows privilege escalation to root — meaning a tool designed to keep systems secure can itself become an attac
www.bleepingcomputer.com · 8d ago · October 5th, 2026
A flaw in Dell System Update allows privilege escalation to root — meaning a tool designed to keep systems secure can itself become an attac
via Mastodon https://www.bleepingcomputer.com/news/security/new-dell-system-update-flaw-lets-hackers-gain-root-privileges/
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-86360 (critical): path traversal in Dell System Update (DSU) CLI lets an unauthenticated remote attacker execute arbitrary code a
www.bleepingcomputer.com · 8d ago · October 6th, 2026
-
update from www.it-connect.fr
Dell PowerEdge servers: critical flaw gives root access — CVE-2026-86360
www.it-connect.fr · 7d ago · October 6th, 2026
You use Dell System Update to maintain
via Mastodon https://www.it-connect.fr/dell-system-update-faille-critique-cve-2026-86360/
-
mentioned by www.bleepingcomputer.com
New # Dell System Update flaw lets hackers gain root privileges https://www. bleepingcomputer.com/news/secu rity/new-dell-system-update-flaw
www.bleepingcomputer.com · 7d ago · October 6th, 2026