CVE Tools
Track your stack

New Dell System Update flaw lets hackers gain root privileges

BleepingComputerBy Sergiu Gatlan

PatchSystem Update (DSU)PowerEdge

Our summary

Dell has released fixes for a critical security hole in its System Update (DSU) command-line tool, used by IT teams to push BIOS, firmware, and software updates to PowerEdge servers running Linux and Windows. Tracked as CVE-2026-86360, the bug stems from a path traversal weakness that could let an unauthenticated remote attacker read files and ultimately run arbitrary code with root privileges, potentially taking over the entire system. Alongside it, Dell also closed four high-severity DSU bugs — two remote code execution issues (CVE-2026-63697, CVE-2026-71168) and two privilege-escalation flaws (CVE-2026-86361, CVE-2026-86362) — and separately patched a pair of maximum-severity issues in its Container Storage Modules (CSM). Dell says none of these are currently known to be exploited, but urges customers to upgrade DSU to version 2.3.0.0 or newer right away, noting that nation-state actors have targeted other Dell products in the past.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. Help Net SecurityDell System Update flaw allows attackers to gain root privileges (CVE-2026-86360)CVE-2026-63697, CVE-2026-71168 +3
  2. The Hacker NewsDell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes NodesCVE-2021-21551, CVE-2026-22769 +2
  3. BleepingComputerDell asks admins to patch max severity CSM flaws as soon as possibleCVE-2021-21551, CVE-2026-22769 +2
  4. The Hacker News⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and MoreCVE-2026-86360, CVE-2026-86361 +1
  5. The Hacker News⚡ Weekly Recap: NetScaler and FortiMail 0-Days, AI Coding Leaks, Spectre v2 and Ransomware ArrestsCVE-2026-63688, CVE-2026-63692
  6. Help Net SecurityWeek in review: FortiBleed is still active, Patch Tuesday forecastCVE-2026-86360
  7. The Hacker NewsUAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux RootkitCVE-2021-21551
  8. Cisco TalosUAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilitiesCVE-2021-21551
  9. The Hacker NewsVerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux AppliancesCVE-2026-22769
  10. MandiantvSphere and BRICKSTORM Malware: A Defender's GuideCVE-2026-22769

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure