Cybersecurity
Dell warns of root-level flaw in System Update tool
Dell said a critical path-traversal bug in its System Update command-line tool could let remote attackers gain root access on unpatched machines, and it told customers to move to version 2.3.0.0 or later.
- Dell said CVE-2026-86360 in System Update could let an unauthenticated remote attacker run code with root privileges on unpatched devices.
- Dell also patched four high-severity DSU flaws and two maximum-severity Container Storage Modules flaws, and it advised customers to upgrade to 2.3.0.0 or later.
- Dell had not said that any of the reported flaws were being actively exploited.
- The article said the FBI and CISA had urged vendors since May 2024 to remove path-traversal weaknesses, and CISA later ordered federal agencies to patch vulnerable Dell systems within three days.
- The article also said Lazarus and UNC6201 had abused earlier Dell vulnerabilities, and that Mandiant and GTIG linked UNC6201 with Silk Typhoon.
Dell said on Thursday that CVE-2026-86360 in the System Update command-line deployment tool could be used remotely without authentication to reach root-level execution on unpatched systems. The company advised customers to install DSU 2.3.0.0 or later.
Dell said it also corrected four high-severity DSU issues, listed as CVE-2026-63697, CVE-2026-71168, CVE-2026-86361 and CVE-2026-86362, plus two maximum-severity Container Storage Modules flaws. It said it had not flagged the bugs as actively exploited.
The article said DSU is used by enterprise administrators to push BIOS, firmware and software updates to Linux and Windows machines on PowerEdge infrastructure. It also said the FBI and CISA have pressed software vendors since May 2024 to remove path-traversal weaknesses before release.
It then cited earlier Dell cases in which Lazarus used CVE-2021-21551 in the dbutil driver to load a Windows rootkit, and Mandiant and GTIG said UNC6201 had used CVE-2026-22769 in Dell RecoverPoint for Virtual Machines since at least mid-2024. They said that activity overlapped with Silk Typhoon, and CISA later gave federal agencies three days to patch vulnerable Dell systems.
Named in this story
Companies
- Dell
- issued the advisory and patched the flaws
- Mandiant
- co-disclosed the later Dell RecoverPoint exploitation
- Ivanti
- was named in the comparison to Silk Typhoon’s earlier attacks
Organisations
- Google Threat Intelligence Group (GTIG)
- co-disclosed the later Dell RecoverPoint exploitation
- North Korean Lazarus hacking group
- used a Dell driver flaw in earlier attacks
- UNC6201
- was reported to have exploited a Dell RecoverPoint flaw
- Silk Typhoon
- was linked to UNC6201 in the article
Governments and agencies
- FBI
- urged vendors to remove path traversal weaknesses
- U.S. Cybersecurity and Infrastructure Security Agency (CISA)
- urged vendors and later ordered agencies to patch Dell systems
Products and systems
- Dell System Update (DSU)
- the deployment tool with the reported vulnerabilities
- PowerEdge
- the server infrastructure DSU was used on
- Container Storage Modules (CSM)
- had two maximum-severity flaws Dell patched
- Dell dbutil driver
- was exploited by Lazarus to deploy a Windows rootkit
- Dell RecoverPoint for Virtual Machines
- contained a flaw exploited since at least mid-2024
- VMware ESXi
- was the platform where hidden network interfaces were created
How the source tells it
The article was mostly a straight security advisory, but it was made more urgent by repeated patch-now language and by side references to government warnings and earlier state-linked abuse.
- Urgency pressure it repeatedly urged immediate updating and cited short deadlines for remediation
- Threat escalation it used Dell’s own description of root-level compromise to frame the flaw
- Moral framing it invoked FBI and CISA language treating path traversal defects as unacceptable