Critical Path Traversal Flaw in Dell System Update (CVE‑2026‑86360) Enables Remote Root Access
What Happened — Dell disclosed a critical path‑traversal vulnerability (CVE‑2026‑86360) in its System Update (DSU) CLI tool that lets an unauthenticated remote attacker execute code with root privileges on unpatched PowerEdge servers. The advisory also patches three related privilege‑escalation flaws (CVE‑2026‑86361, CVE‑2026‑86362) and two remote‑code‑execution bugs (CVE‑2026‑63697, CVE‑2026‑71168).
Why It Matters for Trust & Control Assurance
- The flaw tests the vulnerability‑management and patch‑validation control objective that continuous assurance programs are built to monitor and evidence.
- Without timely patching, organizations lack defensible audit evidence that they exercised due diligence in maintaining a secure configuration.
- Demonstrating continuous, automated proof of patch status directly supports multiple frameworks (e.g., NIST CSF 2.0, ISO 27001) through a single control.
Who Is Affected – Enterprises running Dell PowerEdge servers and relying on DSU for firmware, BIOS, or software distribution (primarily cloud‑infrastructure and data‑center operators).
Recommended Actions
- Deploy Dell System Update 2.3.0.0 or later on all affected assets.
- Integrate automated vulnerability scanning to detect unpatched DSU versions.
- Capture and retain patch‑deployment logs as continuous evidence for audit readiness.
- Review and harden remote access controls to limit unauthenticated network exposure.
Source: BleepingComputer
Technical Notes
- Attack vector: Remote unauthenticated exploitation of a path‑traversal flaw in the DSU CLI.
- CVEs: CVE‑2026‑86360 (critical), CVE‑2026‑63697, CVE‑2026‑71168 (high‑severity RCE), CVE‑2026‑86361, CVE‑2026‑86362 (privilege escalation).
- Data impact: Full OS compromise; potential for data exfiltration, ransomware deployment, or persistence mechanisms.
Source: [Dell Security Advisory]