Dell is urging customers to update its System Update (DSU) software after disclosing a critical vulnerability that could allow unauthenticated attackers to execute arbitrary code with root privileges on vulnerable systems.
The flaw, tracked as CVE-2026-86360, affects Dell System Update versions before 2.3.0.0 and has a CVSS severity score of 9.6. The vulnerability is caused by a path traversal weakness that could allow a remote attacker to access files outside the intended directory and ultimately execute code with root privileges.
Dell System Update is an enterprise tool used to deploy firmware, drivers and software updates across Dell systems, including Linux, Windows and ESXi environments running on PowerEdge infrastructure.
According to Dell, an unauthenticated attacker with remote access could exploit CVE-2026-86360 to gain filesystem access. Successful exploitation could lead to arbitrary code execution with root privileges, potentially allowing an attacker to take complete control of the affected application and underlying operating system.
Dell also disclosed four additional vulnerabilities in System Update. CVE-2026-63697 and CVE-2026-71168 can potentially be exploited for remote code execution, while CVE-2026-86361 and CVE-2026-86362 can be used by low-privileged local attackers to escalate their privileges. All five vulnerabilities affect DSU versions before 2.3.0.0.
Dell recommends customers upgrade System Update to version 2.3.0.0 or later as soon as possible. Dell has also released version 2.3.0.1, which is currently listed on its support site.
The disclosure comes amid continued concerns over vulnerabilities in enterprise management and update software because these tools often operate with elevated privileges. A successful attack against such software can give attackers access to the underlying server operating system and potentially the systems and data managed from it.
Dell has not said that CVE-2026-86360 is being actively exploited in the wild. However, given the vulnerability’s critical severity and the possibility of unauthenticated remote code execution with root privileges, administrators running affected versions should prioritize the update.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Critical Dell System Update Flaw Lets Attackers Gain Root Access
