Critical Dell System Update flaw lets remote attackers gain root access
Summary
Dell warns that an unauthenticated attacker with remote access can exploit a critical path traversal flaw in Dell System Update to execute code as root. Updating to version 2.3.0.0 or later patches the flaws.
Key points
- CVE-2026-86360 affects Dell System Update’s command-line deployment tool for PowerEdge servers running Linux or Windows.
- An unauthenticated attacker with remote access could exploit the path traversal flaw to access the filesystem and execute arbitrary code with root privileges.
- Dell also patched four high-severity System Update flaws: two enabling remote code execution and two enabling privilege escalation.
- Dell recommends upgrading System Update to version 2.3.0.0 or later.
- Dell has not flagged these flaws as actively exploited.
- Dell separately urged administrators to patch two maximum-severity Container Storage Modules vulnerabilities.
Article Details
- Vulnerability Types
- Path traversal in Dell System Update (DSU)
- Remote code execution in two additional Dell System Update (DSU) flaws
- Privilege escalation in two additional Dell System Update (DSU) flaws
- Insufficient access control in the historical Dell dbutil driver flaw
- Hardcoded credentials in the historical Dell RecoverPoint for Virtual Machines flaw
- Severity
- Critical for CVE-2026-86360; high for four other Dell System Update (DSU) flaws; maximum severity for two Container Storage Modules (CSM) flaws.
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
CVE-2021-21551For instance, the North Korean Lazarus hacking group deployed a Windows rootkit on victims' systems by exploiting an insufficient access control vulnerability (CVE-2021-21551) in the Dell dbutil driver.CVE-2026-22769Chinese cyber spies (tracked as UNC6201) had been exploiting a hardcoded-credential vulnerability (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines since at least mid-2024 to create hidden networkCVE-2026-63688That same day, Dell also urged IT administrators to patch two maximum-severity Container Storage Modules (CSM) vulnerabilities (CVE-2026-63688 and CVE-2026-63692) as soon as possible.CVE-2026-63692That same day, Dell also urged IT administrators to patch two maximum-severity Container Storage Modules (CSM) vulnerabilities (CVE-2026-63688 and CVE-2026-63692) as soon as possible.CVE-2026-63697security flaws on Thursday, two that remote attackers can exploit to gain remote code execution (CVE-2026-63697 and CVE-2026-71168) and two more that can be abused for privilege escalation (CVE-2026-86361 andCVE-2026-71168on Thursday, two that remote attackers can exploit to gain remote code execution (CVE-2026-63697 and CVE-2026-71168) and two more that can be abused for privilege escalation (CVE-2026-86361 and CVE-2026-86362).CVE-2026-86360In a Thursday security advisory, the company said the flaw (tracked as CVE-2026-86360) allows threat actors to execute code with root privileges on unpatched devices by exploiting a path traversal weakness.CVE-2026-86361(CVE-2026-63697 and CVE-2026-71168) and two more that can be abused for privilege escalation (CVE-2026-86361 and CVE-2026-86362).CVE-2026-86362and CVE-2026-71168) and two more that can be abused for privilege escalation (CVE-2026-86361 and CVE-2026-86362).
Threat Actors
LazarusThe North Korean hacking group exploited a historical Dell dbutil driver vulnerability to deploy a Windows rootkit.Silk TyphoonA Chinese cyberespionage group that researchers said overlaps with UNC6201; it has targeted government agencies in Ivanti zero-day attacks.UNC6201Suspected Chinese cyber spies tracked as UNC6201 exploited a Dell RecoverPoint for Virtual Machines vulnerability; researchers found overlaps with Silk Typhoon.
Malware
SpawnantThey also found overlaps between UNC6201 and the Silk Typhoon Chinese cyberespionage group, which is known for targeting government agencies with custom Zipline and Spawnant malware in Ivanti zero-day attacks.ZiplineThey also found overlaps between UNC6201 and the Silk Typhoon Chinese cyberespionage group, which is known for targeting government agencies with custom Zipline and Spawnant malware in Ivanti zero-day attacks.
Vendors
Products
Container Storage Modules (CSM)That same day, Dell also urged IT administrators to patch two maximum-severity Container Storage Modules (CSM) vulnerabilities (CVE-2026-63688 and CVE-2026-63692) as soon as possible.Dell dbutil driverFor instance, the North Korean Lazarus hacking group deployed a Windows rootkit on victims' systems by exploiting an insufficient access control vulnerability (CVE-2021-21551) in the Dell dbutil driver.Dell RecoverPoint for Virtual Machinesas UNC6201) had been exploiting a hardcoded-credential vulnerability (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines since at least mid-2024 to create hidden network interfaces on VMware ESXi servers andDell System Update (DSU)"Dell recommends customers upgrade at the earliest opportunity," the company said, advising customers to update Dell System Update (DSU) to 2.3.0.0 or later, which patches the flaws.PowerEdgeDSU lets enterprise IT administrators deploy BIOS, firmware, and software updates onto Linux and Windows systems on PowerEdge enterprise server infrastructure.VMware ESXiDell RecoverPoint for Virtual Machines since at least mid-2024 to create hidden network interfaces on VMware ESXi servers and deploy malware payloads.