Dell Patches Critical Remote Root Execution Vulnerability in System Update Tool
Dell has released a security advisory addressing multiple security vulnerabilities in its Dell System Update (DSU) utility, which is widely used to manage firmware, BIOS, and driver updates across Dell PowerEdge servers. The utility runs on both Linux and Windows Server environments, naturally requiring elevated operating system permissions due to the low-level system updates it executes. The most severe flaw addressed is CVE-2026-86360, a critical path traversal vulnerability boasting a CVSS score of 9.6 that affects all versions of DSU prior to 2.3.0.0. This flaw allows an unauthenticated remote attacker to traverse filesystem directories and achieve arbitrary code execution with full root privileges. Consequently, successful exploitation can result in the complete takeover of the host server and the underlying operating system. Alongside this critical bug, Dell remediated four high-severity issues in DSU, including CVE-2026-86361 and CVE-2026-86362, which allow local privilege escalation via improper permission assignment and broken access controls. The release also resolves CVE-2026-63697, an improper certificate validation issue exploitable by privileged attackers for code execution, and CVE-2026-71168, a local low-privilege path traversal vulnerability. All of these DSU vulnerabilities are resolved in version 2.3.0.0 or higher. Additionally, Dell published a simultaneous advisory resolving two maximum-severity 10.0 CVSS flaws, CVE-2026-63688 and CVE-2026-63692, in its Container Storage Modules (CSM) integration for Kubernetes, patched in CSM version 1.18.0.
Read more about Dell Patches Critical Remote Root Execution Vulnerability in System Update Tool