Dell has issued an urgent security advisory warning customers to apply patches for a critical vulnerability affecting its System Update (DSU) command-line interface deployment tool. The flaw enables threat actors to execute code with elevated privileges on unpatched infrastructure by exploiting a path traversal weakness. DSU is used by enterprise IT teams to roll out BIOS, firmware, and software updates across PowerEdge server deployments running Linux and Windows.
The vulnerability, designated CVE-2026-86360, poses a severe risk because it requires no authentication and can be triggered remotely. According to Dell, "An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for [an] attacker. This vulnerability is considered critical because it can be leveraged by an unauthenticated attacker to execute arbitrary code with root privileges. Successful exploitation may allow complete compromise of the vulnerable application and underlying operating system."
The FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have been pushing software vendors since May 2024 to eliminate path traversal weaknesses before release, characterizing such defects as "unforgivable" since at least 2007.
Additional flaws patched
Dell released fixes for four additional high-severity vulnerabilities in System Update on the same day. Two of these flaws—CVE-2026-63697 and CVE-2026-71168—can be exploited remotely to achieve code execution, while the other two—CVE-2026-86361 and CVE-2026-86362—enable privilege escalation attacks.
Dell stated that "Dell recommends customers upgrade at the earliest opportunity," directing users to update to System Update version 2.3.0.0 or later to address all identified issues.
In a separate advisory issued the same day, Dell urged administrators to patch two maximum-severity Container Storage Modules (CSM) vulnerabilities (CVE-2026-63688 and CVE-2026-63692) without delay.
History of Dell vulnerability exploitation
Although Dell has not yet observed active exploitation of these newly disclosed flaws, state-sponsored threat groups have targeted Dell products in previous campaigns. The North Korean Lazarus group, for example, deployed a Windows rootkit by exploiting an insufficient access control flaw (CVE-2021-21551) in the Dell dbutil driver.
More recently, Mandiant and the Google Threat Intelligence Group disclosed in February that a suspected Chinese espionage outfit designated UNC6201 had been exploiting a hardcoded-credential vulnerability (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines since mid-2024 or earlier. The group used this access to establish covert network interfaces on VMware ESXi servers and deploy malicious code. Researchers also identified connections between UNC6201 and Silk Typhoon, a Chinese cyberespionage collective known for targeting government entities using custom Zipline and Spawnant malware in Ivanti zero-day attacks.
Following these revelations, CISA mandated that federal agencies patch vulnerable Dell systems within three days.