Dell System Update (DSU) Path‑Traversal (CVE‑2026‑86360) Enables Remote Root Code Execution
What It Is — Dell System Update (DSU) is the utility used to push driver, BIOS and firmware updates to PowerEdge servers. CVE‑2026‑86360 is a path‑traversal flaw that permits an unauthenticated remote attacker to write arbitrary files and execute code with root privileges.
Exploitability — The vulnerability carries a CVSS 9.6 (Critical) score. No public exploits have been observed, but the attack requires only network access to the DSU management interface.
Affected Products — Dell System Update versions < 2.3.0.0 on Dell PowerEdge servers.
Why It Matters for Trust & Control Assurance
- Highlights the control objective of timely patch‑management and vulnerability remediation, a cornerstone of continuous assurance across frameworks such as NIST CSF 2.0.
- Without documented, up‑to‑date patches, organizations cannot produce a defensible audit trail, weakening trust signals to regulators and customers.
- Continuous monitoring of patch status provides concrete evidence that the organization is exercising due diligence in its security posture.
Recommended Actions
- Inventory all DSU installations and upgrade to version 2.3.0.0 or later immediately.
- Integrate DSU version and patch‑status data into your configuration‑management database; automate evidence collection for audit purposes.
- Restrict network access to DSU management interfaces (e.g., VLAN segmentation, firewall rules) to limit unauthenticated exposure.
Source: Help Net Security