A critical vulnerability in Dell’s System Update tool has been discovered, allowing hackers to gain root privileges on affected devices. The flaw, tracked as CVE-2026-86360, was revealed in a security advisory from Dell, which warned customers to patch the issue as soon as possible.
Dell System Update is a command-line interface (CLI) deployment tool used by enterprise IT administrators to deploy BIOS, firmware, and software updates onto Linux and Windows systems on PowerEdge servers. The vulnerability allows an unauthenticated attacker with remote access to exploit a path traversal weakness, leading to file system access for the attacker. If left unpatched, this could result in complete compromise of the vulnerable application and underlying operating system.
The FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have been warning software companies about the dangers of path traversal weaknesses since May 2024. These types of security issues are considered “unforgivable” due to their potential for exploitation by malicious actors. Despite this, Dell has now patched four high-severity Dell System Update security flaws, including two that allow remote attackers to gain remote code execution and two more that can be abused for privilege escalation.
Dell is urging customers to update their Dell System Update (DSU) to version 2.3.0.0 or later, which patches the vulnerabilities. This is not an isolated incident; state-backed hacking groups have been known to exploit other Dell vulnerabilities in recent attacks. For instance, the North Korean Lazarus group deployed a Windows rootkit on victims’ systems by exploiting an insufficient access control vulnerability in the Dell dbutil driver.
The fact that these vulnerabilities are being exploited highlights the importance of keeping software up-to-date and patching flaws as soon as they become available. IT administrators should prioritize updating their Dell System Update tool to prevent potential attacks. Furthermore, with the rise of AI-powered attacks, it’s essential for organizations to have a robust security posture in place, including regular updates, backups, and employee training.
To protect themselves from these types of vulnerabilities, users should ensure that they are running the latest version of Dell System Update and apply all available patches. Regularly monitoring system logs and implementing intrusion detection systems can also help identify potential attacks before they cause significant damage. By taking proactive measures to address security weaknesses, organizations can minimize their risk of being compromised by malicious actors.
Source: Bleeping Computer — 2026-10-05