Dell patches critical 9.6 CVSS vulnerability in System Update tool

Dell has released a security update to address a critical vulnerability in its Dell System Update (DSU) tool, which is used to manage BIOS, firmware, and software updates for PowerEdge servers on Windows and Linux platforms.

The most severe flaw, identified as CVE-2026-86360, is a path traversal vulnerability with a CVSS score of 9.6. If exploited, an unauthenticated attacker could remotely execute malicious code with root privileges on Linux systems or SYSTEM privileges on Windows. While the vulnerability is severe, the attack vector requires user interaction.

In addition to the primary flaw, the update (version 2.3.0.0) addresses four other high-severity vulnerabilities. These include two flaws that allow for remote code execution and two that enable privilege escalation. As of early October 2026, there have been no reports of this specific vulnerability being exploited in the wild.