Dell System Update: Unauthenticated path traversal leading to root code execution
Summary
Dell System Update (DSU) versions prior to 2.3.0.0 contain a path traversal vulnerability (CWE-22) that can be exploited remotely without authentication. According to Dell, a successful attacker can access the filesystem and execute arbitrary code with root privileges, which may lead to full compromise of the application and the underlying operating system. The CVSS base score is 9.6 (critical); user interaction is part of the vector. Dell reports no active exploitation.
Affected
- Dell System Update (DSU), all versions prior to 2.3.0.0
- Runs on Linux and Windows; used to apply driver, BIOS and firmware updates on Dell PowerEdge servers
Fixed in
- Dell System Update 2.3.0.0 or later (fixes CVE-2026-86360 and four other CVEs in DSA-2026-324)
Workaround
- Unknown. Dell documents no workaround.
- Interim compensating control (not from Dell): restrict access to DSU hosts to trusted admin networks and users until patched.
Exploitation
- Dell has not reported exploitation in the wild.
- No public proof-of-concept found in the research; this is not a confirmed absence.
- CISA KEV status: not verified.
Our recommendation
- Inventory all DSU installations on Windows and Linux systems, including older admin hosts, and record their versions.
- Upgrade DSU to version 2.3.0.0 or later, starting with hosts reachable from untrusted networks.
- Until patched, restrict network access to DSU hosts to trusted admin networks.
- Review logs for path traversal patterns and unexpected privileged or filesystem activity.
- Re-check the CISA KEV catalog and Dell's advisory for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Dell DSA-2026-324 www.dell.com
- University of Toronto advisory security.utoronto.ca
- Help Net Security www.helpnetsecurity.com
- Security Affairs securityaffairs.com
- TheHackerWire www.thehackerwire.com
- Tenable plugin 364718 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:07.
Original description (NVD)
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This vulnerability is considered critical because it can be leveraged by an unauthenticated attacker to execute arbitrary code with root privileges. Successful exploitation may allow complete compromise of the vulnerable application and underlying operating system. Dell recommends customers upgrade at the earliest opportunity.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.