New Dell System Update flaw lets hackers gain root privileges

Dell System Update (DSU) CLI deployment tool contains a critical path traversal vulnerability (CVE-2026-86360) that permits unauthenticated remote attackers to execute arbitrary code with root privileges on affected systems. This vulnerability allows filesystem access and potential full compromise of the underlying operating system. Dell has also patched additional high-severity vulnerabilities in DSU that enable remote code execution and privilege escalation. The vendor advises upgrading to DSU version 2.3.0.0 or later to remediate these issues. The advisory highlights the risk of such path traversal flaws and references prior attacks leveraging Dell vulnerabilities by state-sponsored groups. No known active exploitation of this specific flaw has been reported.

Successful exploitation of CVE-2026-86360 allows an unauthenticated remote attacker to execute arbitrary code with root privileges on affected Dell PowerEdge servers using DSU. This can lead to complete compromise of the DSU application and the underlying operating system, potentially enabling full control over the affected system. The vulnerability poses a critical risk to enterprise environments relying on DSU for BIOS, firmware, and software updates.

Dell has released an official fix in Dell System Update (DSU) version 2.3.0.0 or later that addresses this vulnerability along with other high-severity issues. Customers are strongly advised to upgrade to DSU 2.3.0.0 or newer immediately to remediate the flaw. No other mitigation steps are indicated beyond applying the vendor's update.