New Dell System Update flaw hands attackers root access

Dell has issued a warning to its enterprise customers, strongly advising them to fix a critical vulnerability in the Dell System Update (DSU) command-line tool as soon as possible. The utility is used by IT administrators to deploy BIOS, firmware, and software updates onto PowerEdge servers running Linux and Windows.

The flaw

Tracked as CVE-2026-86360, the vulnerability stems from a path traversal weakness. According to Dell, an unauthenticated attacker with remote access could potentially exploit it to gain filesystem access. The company rates it critical because it allows arbitrary code execution with root privileges, which could lead to full compromise of both the application and the underlying operating system.

Notably, this class of bug has long been in regulators' crosshairs. Since May 2024, the FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have urged developers to eliminate path traversal weaknesses before shipping their products, pointing out that such defects have been called "unforgivable" since at least 2007.

What else was patched

On the same day, Dell fixed four more high-severity flaws in System Update: two allow remote code execution (CVE-2026-63697 and CVE-2026-71168), and two enable privilege escalation (CVE-2026-86361 and CVE-2026-86362). All are addressed by upgrading DSU to version 2.3.0.0 or later.

Separately, the company urged administrators to urgently patch two maximum-severity vulnerabilities in its Container Storage Modules (CVE-2026-63688 and CVE-2026-63692).

Threat context

Dell has not flagged any of these flaws as actively exploited. History, however, shows that state-backed groups are quick to weaponize Dell vulnerabilities. North Korea's Lazarus group, for example, once deployed a Windows rootkit by exploiting an insufficient access control flaw in the Dell dbutil driver (CVE-2021-21551).

More recently, in February, Mandiant and the Google Threat Intelligence Group reported that suspected Chinese cyber spies tracked as UNC6201 had, since at least mid-2024, exploited a hardcoded-credential flaw in Dell RecoverPoint for Virtual Machines to create hidden network interfaces on VMware ESXi servers. Analysts found overlaps between UNC6201 and the Silk Typhoon espionage group, known for targeting government agencies. Days later, CISA ordered federal agencies to patch vulnerable Dell systems within three days.

Source: Bleeping Computer