Critical Dell System Update Tool Vulnerability Allows Attackers to Execute Code as Root User

What happened?

Dell has released security updates for five vulnerabilities in Dell System Update (DSU), including a critical flaw that could let an unauthenticated remote attacker execute code with root privileges. The issues affect versions before 2.3.0.0, and Dell urges customers to upgrade at the earliest opportunity. The company published security advisory DSA-2026-324 on October 1, 2026. DSU is a command-line tool that helps administrators deploy BIOS, firmware, and software updates across Dell PowerEdge servers running Linux and Windows, making its security important for enterprise server management.

Key details

• Dell released security updates for five vulnerabilities in Dell System Update (DSU).
• A critical path traversal flaw lets unauthenticated remote attackers execute code as root.
• The critical vulnerability CVE-2026-86360 has a CVSS score of 9.6 and requires user interaction.
• Improper certificate validation (CVE-2026-63697) allows remote execution by high-privilege attackers.
• Another path traversal flaw (CVE-2026-71168) needs local low-privilege access but can lead to remote execution.
• Dell credits researcher Ori Gabriel for reporting the critical path traversal and certificate validation issues.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.