Full Report
Dell warned customers to patch a critical vulnerability in the System Update (DSU) command-line interface (CLI) deployment tool as soon as possible. [...]
Analysis Summary
# Vulnerability: Dell System Update (DSU) Path Traversal and RCE
## CVE Details
- **CVE ID:** CVE-2026-86360 (Primary Critical Flaw)
- **CVSS Score:** Not explicitly listed, but categorized as **Critical** by Dell.
- **CWE:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory / Path Traversal)
- **Additional CVEs Patched:**
- CVE-2026-63697 & CVE-2026-71168 (High - Remote Code Execution)
- CVE-2026-86361 & CVE-2026-86362 (High - Privilege Escalation)
## Affected Systems
- **Products:** Dell System Update (DSU) command-line interface (CLI) deployment tool.
- **Versions:** All versions prior to 2.3.0.0.
- **Configurations:** Enterprise IT environments utilizing DSU to deploy BIOS, firmware, and software updates on Linux and Windows-based PowerEdge server infrastructure.
## Vulnerability Description
The primary flaw (CVE-2026-86360) is a path traversal weakness within the DSU CLI tool. This vulnerability allows an unauthenticated attacker to bypass directory restrictions and access the underlying filesystem. Due to the nature of the DSU tool—which requires elevated permissions to perform system updates—an attacker can leverage this access to execute arbitrary code with **root privileges**, potentially leading to a full compromise of the application and the host operating system.
## Exploitation
- **Status:** Not currently observed as exploited in the wild; no public PoC mentioned in the report.
- **Complexity:** Not specified, but generally low for path traversal flaws.
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** Critical (Filesystem access and data theft).
- **Integrity:** Critical (Unauthorized code execution and system modification).
- **Availability:** Critical (Potential for complete system takeover or denial of service).
## Remediation
### Patches
- **Dell System Update (DSU) 2.3.0.0:** Customers are advised to upgrade to version 2.3.0.0 or later immediately to resolve the path traversal and associated RCE/privilege escalation flaws.
### Workarounds
- No specific workarounds were provided in the article. Dell emphasizes that immediate patching is the only recommended course of action given the critical nature of the flaw.
## Detection
- **Indicators of Compromise:** Unusual file access patterns in DSU logs or unexpected directory traversal sequences (e.g., `../`) in command inputs.
- **Detection methods:** Monitor for unauthorized administrative-level changes or new, unrecognized root-level processes on PowerEdge servers running vulnerable versions of DSU.
## References
- **Vendor Advisory:** [Dell Security Advisory DSA-2026-324] hxxps://www[.]dell[.]com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities
- **General News:** hxxps://www[.]bleepingcomputer[.]com/news/security/new-dell-system-update-flaw-lets-hackers-gain-root-privileges/