CVE-2026-86360 – Dell System Update
“The tool you trust to keep every Dell machine current is now the open door; patch the updater before an attacker uses it to update you.”
Dell System Update 2.3.0.0 fixes five vulnerabilities that affect all earlier versions. The most serious is CVE-2026-86360, a path traversal flaw with a CVSS score of 9.6, Critical severity. An unauthenticated remote attacker can use it to reach the filesystem, and Dell states it can be leveraged to execute arbitrary code with root privileges, which can fully compromise the application and the underlying operating system. Dell recommends upgrading at the earliest opportunity.
The update also fixes four High severity flaws. CVE-2026-63697 has a CVSS score of 7.6, High severity, and is an improper certificate validation flaw that a highly privileged remote attacker can use to execute code remotely. CVE-2026-71168 has a CVSS score of 7.3, High severity, and is a path traversal flaw that a low-privileged local attacker can use to execute code remotely. CVE-2026-86361 has a CVSS score of 8.2, High severity, and comes from incorrect permission assignment on a critical resource. CVE-2026-86362 has a CVSS score of 8.2, High severity, and comes from improper access control. A low-privileged local attacker can use either of these last two flaws to elevate privileges. All five flaws lead to elevation of privilege, so a fleet-wide upgrade to 2.3.0.0 should be a same-day priority.
Key Details
- Affected Product
- Dell System Update
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- Required
- CWE Classification
- CWE-22