Severity: Critical (CVSS up to 9.6)

Status: Patch available. No known active exploitation reported at the time of writing. Upgrade promptly.

1. Summary
2. Vulnerability details
3. Impacted versions
4. Recommendations
5. References
6. Support

Dell has fixed five vulnerabilities in Dell System Update (DSU), a command-line tool used by administrators to deploy BIOS, firmware and software updates to Dell PowerEdge servers. The most serious flaw, CVE-2026-86360 (CVSS 9.6), is a path traversal vulnerability that could allow an unauthenticated remote attacker to gain filesystem access and potentially execute arbitrary code with root privileges, resulting in complete compromise of the affected system. Four additional vulnerabilities could allow remote code execution or local privilege escalation.

• Dell System Update versions prior to 2.3.0.0 are affected
• Fixed version: Dell System Update 2.3.0.0 or later

• Upgrade Dell System Update to version 2.3.0.0 or later as soon as possible.
• Identify PowerEdge systems running older DSU versions and prioritize any systems where DSU is accessible from remote or untrusted networks.
• Until the update is completed, restrict remote access to systems running vulnerable DSU versions to trusted administrative networks and users.
• Review affected systems for unexpected privileged activity or filesystem changes if there is reason to suspect compromise, since successful exploitation of CVE-2026-86360 could result in root-level code execution.

• Dell Security Advisory DSA-2026-324
• BleepingComputer: New Dell System Update flaw lets hackers gain root privileges

As always, please let us know if you have any questions or concerns or see unusual activity on your systems that you believe might be associated with this or any other vulnerability. Please send these communications to security.response@utoronto.ca.