Critical severity · published Oct 6, 2026
CVE-2026-86360
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability
9.6
CVSS
0.6%
EPSS
No
On KEV
Description
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This vulnerability is considered critical because it can be leveraged by an unauthenticated attacker to execute arbitrary code with root privileges. Successful exploitation may allow complete compromise of the vulnerable application and underlying operating system. Dell recommends customers upgrade at the earliest opportunity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SU
System Update · Dell
before 2.3.0.0 or later · source: vendor, NVD
In the news
ThreatIntelCritical
Dell System Update flaw allows attackers to gain root privileges (CVE-2026-86360)
Dell is urging customers to patch a vulnerability (CVE-2026-86360) in Dell System Update (DSU) that could allow an unauthenticated remote attacker to execute arbitrary code with root privileges. DSU is a tool used by enterprise IT administrators to apply driver, BIOS, and firmware updates to Dell PowerEdge servers. About CVE-2026-86360 CVE-2026-86360 is a path traversal vulnerability with a CVSS base score of 9.6 that affects DSU versions prior to 2.3.0.0. “An unauthenticated attacker with remote … More →
The post Dell System Update flaw allows attackers to gain root privileges (CVE-2026-86360) appeared first on Help Net Security .
Oct 6, 2026·Help Net Security
VulnerabilityCritical
Dell Urges Customers to Patch Critical DSU Flaw That Can Give Attackers Root Access
Dell warns that a critical DSU flaw lets attackers run code as root. Customers should patch affected PowerEdge systems as soon as possible. Dell urged customers to patch a critical flaw, tracked as CVE-2026-86360 (CVSS score of 9.6), in its System Update (DSU) tool. The vulnerability is a path traversal issue that can let attackers […]
Oct 6, 2026·Security Affairs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86360
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86360
vendor-advisory
https://www.dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities
More from System Update
8.2
CVE-2026-86362
Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability
8.2
CVE-2026-86361
Dell System Update, versions prior to 2.3.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability
7.8
CVE-2026-71168
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability
7.2
CVE-2026-63697
Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability
6.0
CVE-2022-34404
Dell System Update, version 2.0.0 and earlier, contains an Improper Certificate Validation in data parser module