Dell DSU CVE-2026-86360: Patch PowerEdge Servers for Critical Root Code Execution

BleepingComputer reported that Dell warned customers to patch a critical vulnerability in the System Update (DSU) command-line interface (CLI) deployment tool as soon as possible. Dell's advisory, DSA-2026-324, first went out on October 1, 2026. It covers five CVEs, and every DSU version before 2.3.0.0 is affected.

What DSU is, and why Windows Server admins should care​

DSU is not the consumer Dell update app that most laptop owners see. DSU lets enterprise IT administrators deploy BIOS, firmware, and software updates onto Linux and Windows systems on PowerEdge enterprise server infrastructure. Dell's own download pages say it can identify the available updates, select the relevant updates, and deploy the updates on multiple systems.

On Windows, this matters because of the platforms Dell supports. An earlier DSU release, version 2.1.2.0, listed AZURE STACK HCI and Windows Server 2022 LTSC and Windows Server 2025 LTSC, alongside Red Hat, SUSE, Ubuntu and VMware ESXi 7.0. If your Hyper-V hosts or Azure Local clusters run on PowerEdge hardware and you use DSU for patching, this advisory applies to you.

Dell's advisory also points Linux admins to a detail worth knowing. DSU for Linux can work with either the Dell Enterprise Catalog (or a custom catalog created using Dell Repository Manager) or the Dell Linux Repository for access to Linux update packages. If you run your own catalogs, include the DSU package itself in your update plans.

Summary: DSU is a privileged server tool for PowerEdge systems on Windows Server, Azure Stack HCI, Linux and ESXi. Ordinary Dell PCs are not the target here.

The critical flaw: CVE-2026-86360​

Dell describes CVE-2026-86360 as a path traversal flaw, filed under "Improper Limitation of a Pathname to a Restricted Directory." Dell's own wording: "An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for [an] attacker," the company Dell said. "This vulnerability is considered critical because it can be leveraged by an unauthenticated attacker to execute arbitrary code with root privileges. Successful exploitation may allow complete compromise of the vulnerable application and underlying operating system."

Several vulnerability databases repeat the headline figures: Dell System Update flaw CVE-2026-86360 carries a CVSS 9.6 and could allow attackers to execute code with root privileges. Those same records show the CVE entry was published on 2 Oct 2026.

The CVSS vector adds a caveat. Dell scores the flaw CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. In plain terms:

• AV:N: it can be reached over the network.
• AC:L: the attack is not complicated.
• PR:N: the attacker needs no account.
• UI:R: someone has to do something for the attack to work.

So this is not a fire-and-forget network worm. Some user action is needed, possibly an admin running a DSU operation. Dell has not said what that action is. Still, a 9.6 score with changed scope and high impact on confidentiality, integrity and availability belongs at the top of the patch queue.

The flaw type also has a history. In May 2024, CISA and the FBI published a Secure by Design alert urging software makers to get rid of directory traversal bugs. The alert noted that such flaws have been called "unforgivable" since at least 2007. Two years later, one of these bugs is still showing up in a tool that runs updates with root privileges.

The other four DSU vulnerabilities​

BleepingComputer reported that Dell also patched four high-severity Dell System Update security flaws on Thursday, two that remote attackers can exploit to gain remote code execution (CVE-2026-63697 and CVE-2026-71168) and two more that can be abused for privilege escalation (CVE-2026-86361 and CVE-2026-86362). Dell's advisory describes some of these more narrowly than "remote attackers":

Every one of these vectors includes UI:R. Dell credits Ori Gabriel with reporting CVE-2026-86360 and CVE-2026-63697, "saltedfish" with CVE-2026-86361 and CVE-2026-86362, and Nir Yehoshua of Cipher Security Labs with CVE-2026-71168.

The certificate-validation bug may get the least attention, but it deserves more. An update tool that doesn't check certificates properly is risky by design: it is supposed to trust only genuine packages. Dell does say exploitation requires a high-privileged attacker, which limits the risk somewhat.

Summary: One critical flaw, four high-severity ones. Two of them give a local foothold a path to more privileges, which is the second step attackers usually need after getting in.

What to do now​

"Dell recommends customers upgrade at the earliest opportunity," the company said, advising customers to update Dell System Update (DSU) to 2.3.0.0 or later, which patches the flaws. Dell's advisory lists no workaround. A practical plan:

1. Find every DSU install. Check PowerEdge hosts on Windows Server, Azure Stack HCI, Linux and ESXi, including standalone boxes outside central management.
2. Flag anything older than 2.3.0.0. Dell's advisory says every earlier version is affected.
3. Get the right package from Dell. Dell's download record for DSU 2.3.0.0 (A00) shows a July 28, 2026 release and includes a Windows 64-bit .EXE, Linux packages and a .tar.gz archive. Check the checksums Dell publishes before you deploy.
4. Don't treat 2.3.0.0 as the end point. It is the minimum fixed version. Dell's support documentation already references DSU 2.3.0.1 material updated in mid-September, so "or later" is the instruction to follow.
5. Restrict who can run DSU. Until every host is patched, limit who can run DSU and which catalogs or repositories it can use. This is general hardening advice, not a Dell-documented mitigation.

Note the timing. The fixed build appeared in July, but the advisory didn't arrive until October 1. Shops that already moved to 2.3.0.0 or later in their normal update cycle may be covered. Everyone else is now behind.

A separate Dell advisory: Container Storage Modules​

On the same day, Dell published a separate advisory, DSA-2026-448, for Dell Container Storage Modules (CSM). It is not a DSU issue. It matters for teams running Kubernetes on Dell storage. Both CVE-2026-63688 and CVE-2026-63692 are scored CVSS 10.0:

• CVE-2026-63688 is a missing-authentication flaw in the CSM Authorization storage gRPC server. Dell says it could expose storage backend administrator credentials for all registered storage arrays.
• CVE-2026-63692 affects the authorization proxy and tenant service. Dell says an unauthenticated network attacker could gain full administrative control of the authorization service.

The CSM advisory lists several more flaws. One is a hard-coded credentials bug, CVE-2026-54472, where Dell tells customers to upgrade and also to rotate any JWT signing secrets right away. According to Dell's remediation table, versions before 1.17.0 are affected and 1.18.0 or later is fixed. Dell says no workarounds are available.

Is anyone exploiting these yet?​

BleepingComputer reported that Dell hasn't flagged any of these flaws as actively exploited, and the vulnerability tracker OffSeq says no known active exploitation of this specific flaw has been reported. That doesn't mean nobody is exploiting them. It only means no one has said so. BleepingComputer also notes that state-backed groups have used other Dell vulnerabilities in recent years, so server management software clearly draws serious attackers.

The bottom line: Patch DSU to 2.3.0.0 or later on every PowerEdge host, Windows and Linux alike. If you run Dell CSM, handle that advisory separately. Don't let the UI:R detail lull you into waiting.