Dell System Update flaw allows attackers to gain root privileges (CVE-2026-86360)

Dell has released a fix for a severe security flaw in its Dell System Update (DSU) utility, a tool used by enterprise administrators to deploy driver, BIOS, and firmware updates on PowerEdge servers. Tracked as CVE-2026-86360 and rated 9.6 on the CVSS scale, the path traversal bug affects all DSU releases before version 2.3.0.0 and could let an attacker without any credentials run code as root over the network, potentially taking full control of both the application and the host system. Dell says it has no evidence of active exploitation but strongly urges customers to upgrade immediately to DSU 2.3.0.0 or later. Alongside this flaw, Dell also patched four other high-severity DSU bugs — CVE-2026-63697 and CVE-2026-71168, which enable remote code execution, and CVE-2026-86361 and CVE-2026-86362, which allow privilege escalation — credited to researchers Ori Gabriel, saltedfish, and Nir Yehoshua of Cipher Security Labs.