Root Access Through a Server Update Tool: Dell’s DSU Fix on One Page, Plus a Rollout Checklist
Dell has patched CVE-2026-86360, a critical path traversal flaw in Dell System Update that can give unauthenticated attackers root on PowerEdge servers. Here is the spec sheet and a checklist.
The tools that keep servers updated usually run with the highest privileges on the machine, which makes a flaw in one of them especially serious. Dell is urging customers to update Dell System Update, or DSU, after fixing a critical bug that can hand an attacker root control. Here is the one-page summary, followed by a checklist for rolling out the fix.
Spec sheet
- Product: Dell System Update (DSU), a command-line deployment tool administrators use to push BIOS, firmware and software updates to Linux and Windows systems on Dell PowerEdge servers.
- Main flaw: CVE-2026-86360, rated critical.
- Weakness type: Path traversal.
- Who can exploit it: An unauthenticated attacker with remote access.
- Impact, per Dell: Filesystem access, arbitrary code execution with root privileges, and possible complete compromise of both the application and the underlying operating system.
- Also fixed: Four high-severity DSU bugs. CVE-2026-63697 and CVE-2026-71168 allow remote code execution; CVE-2026-86361 and CVE-2026-86362 allow privilege escalation.
- Fixed version: DSU 2.3.0.0 or later.
- Advisory published: Thursday, the same day Dell patched two maximum-severity flaws in its Container Storage Modules.
- Known exploitation: Dell has not flagged any of these bugs as exploited.
Why a “not yet exploited” Dell bug still deserves attention
Path traversal is an old and well-understood class of bug. The FBI and CISA have been urging software makers since May 2024 to eliminate it before shipping, noting it has been called “unforgivable” since at least 2007. Attackers have also used other Dell flaws before. North Korea’s Lazarus group exploited a Dell driver bug (CVE-2021-21551) to install a Windows rootkit. In February, Mandiant and Google Threat Intelligence Group reported that suspected Chinese spies tracked as UNC6201 had abused a hardcoded-credential flaw in Dell RecoverPoint for Virtual Machines (CVE-2026-22769) since at least mid-2024. CISA then ordered federal agencies to patch within three days.
Rollout checklist
- Find every server where DSU is installed, including older PowerEdge hosts and systems a vendor set up for you.
- Record the DSU version on each one. Anything earlier than 2.3.0.0 needs updating.
- Upgrade DSU to 2.3.0.0 or later, starting with servers reachable from other networks or the internet.
- Confirm the new version after the upgrade rather than assuming the job succeeded.
- Review who and what can reach your server management interfaces remotely, and narrow it where you can.
- Add DSU and similar update agents to your regular patch inventory so they are not forgotten next time.
The details above come from Sergiu Gatlan’s BleepingComputer report on the Dell advisory.
What this means for your company
- Management tools need patching too. Update utilities, agents and admin consoles often sit outside normal patch reports, yet they run with full control of the server.
- Segment server administration. Keep management traffic on a restricted network so a remote attacker cannot easily reach these tools.
- Ask your provider. If someone else maintains your servers, ask whether they use DSU and when it will be updated.
Need help finding and updating the management tools running on your servers? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
