Dell Patches Critical System Update Flaw Allowing Root Access
Dell has issued a security advisory warning customers about a critical vulnerability in its System Update (DSU) command-line interface tool that could allow attackers to gain full control of affected systems. The flaw, tracked as CVE-2026-86360, stems from a path traversal weakness in the DSU deployment tool used by enterprise IT administrators to manage BIOS, firmware, and software updates on PowerEdge server infrastructure running Linux and Windows.
According to Dell’s advisory, an unauthenticated attacker with remote access to a vulnerable system could exploit this weakness to execute arbitrary code with root privileges. Successful exploitation could lead to complete compromise of both the DSU application and the underlying operating system, granting attackers unrestricted filesystem access and control over the host.
DSU Tool Exposes Enterprise Systems to Remote Code Execution
The Dell System Update (DSU) utility is designed to streamline update deployment across large-scale enterprise environments. However, the path traversal flaw in its CLI component undermines this purpose by allowing attackers to bypass intended access controls. Dell emphasized that no authentication is required for exploitation, making internet-facing or poorly segmented systems particularly vulnerable.
The company stated that the vulnerability is considered critical due to its potential for full system compromise. Dell urged immediate action, noting that the flaw could be leveraged to install malware, exfiltrate data, or establish persistent access within enterprise networks.
Multiple High-Severity Flaws Patched in Same Advisory
Alongside CVE-2026-86360, Dell addressed four additional high-severity vulnerabilities in the DSU tool during the same security update. Two of these flaws—CVE-2026-63697 and CVE-2026-71168—could be exploited by remote attackers to achieve remote code execution. The other two, CVE-2026-86361 and CVE-2026-86362, relate to privilege escalation vectors that could allow attackers to elevate their access after initial compromise.
All five DSU-related vulnerabilities are resolved in version 2.3.0.0 or later of the Dell System Update software. Dell strongly recommends that administrators upgrade to this version or newer as soon as possible to mitigate the risks.
Dell Also Patches Critical CSM Vulnerabilities
On the same day, Dell issued separate advisories for two maximum-severity flaws in its Container Storage Modules (CSM) product, tracked as CVE-2026-63688 and CVE-2026-63692. These vulnerabilities also require immediate patching, though no details about their exploitability or impact were disclosed in the advisory.
Dell confirmed that, as of the advisory date, none of the newly disclosed vulnerabilities had been observed in active exploitation campaigns. However, the company highlighted historical abuse of similar Dell vulnerabilities by sophisticated threat actors.
Past Exploitation by Nation-State Groups
Dell referenced prior incidents where its products were targeted by state-backed hackers. In one case, the North Korean Lazarus group exploited an insufficient access control vulnerability in the Dell dbutil driver (CVE-2021-21551) to deploy a Windows rootkit on victim systems.
More recently, in February 2026, Mandiant and the Google Threat Intelligence Group (GTIG) reported that a Chinese cyber espionage group tracked as UNC6201 had been exploiting a hardcoded-credential flaw in Dell RecoverPoint for Virtual Machines (CVE-2026-22769) since at least mid-2024. This exploitation allowed attackers to create hidden network interfaces on VMware ESXi servers and deploy malware payloads.
The analysis also noted overlaps between UNC6201 and the Silk Typhoon group, which is known for targeting government agencies using custom malware like Zipline and Spawnant in Ivanti zero-day attacks.
CISA Reinforces Urgency of Patching
The disclosure aligns with ongoing warnings from U.S. cybersecurity authorities. Since May 2024, the FBI and CISA have urged software vendors to eliminate path traversal weaknesses from products before release, describing such flaws as "unforgivable" and noting they have been recognized as serious security issues since at least 2007.
Following the UNC6201 revelations, CISA previously issued directives requiring federal agencies to patch vulnerable Dell systems within three days. While no such emergency order was issued for the current DSU flaws, the advisory reinforces the importance of timely patching in light of persistent threats targeting enterprise infrastructure.
Source: BleepingComputer