Dell patches unauthenticated root flaw CVE-2026-86360 in its PowerEdge update tool

Dell's advisory describes the attack in two steps. A path traversal gives a remote attacker access to the filesystem, and Dell says that access can be turned into code running as root ^[3]. According to Dell, an unauthenticated attacker with remote access could potentially exploit the vulnerability to gain filesystem access ^[4]. In the same advisory the company said: "This vulnerability is considered critical because it can be leveraged by an unauthenticated attacker to execute arbitrary code with root privileges. Successful exploitation may allow complete compromise of the vulnerable application and underlying operating system." ^[5]

For exploitability, few bug profiles rate worse than an unauthenticated remote flaw that ends in root code execution. Dell's own wording still hedges, with "could potentially" and "may" ^[4][5]. BleepingComputer's report does not say which DSU component accepts remote input, or whether one compromised instance can reach other servers. On the published evidence, exposure is counted host by host: every system running a DSU build older than 2.3.0.0 ^[7].

Older builds have more than one remote path in. Version 2.3.0.0 fixes five DSU flaws ^[9]. Three of them allow remote code execution: the critical bug plus CVE-2026-63697 and CVE-2026-71168 ^[11][6]. The other two, CVE-2026-86361 and CVE-2026-86362, are privilege escalation bugs ^[6]. Dell first told customers to patch as soon as possible ^[1]. "Dell recommends customers upgrade at the earliest opportunity," the company said ^[7].

Path traversal is an old bug class. The FBI and CISA have urged software makers since May 2024 to remove path traversal weaknesses before shipping, saying such issues "have been called 'unforgivable' since at least 2007" ^[10].

State-backed attackers have used flaws in Dell software before. North Korea's Lazarus group exploited CVE-2021-21551, an insufficient access control flaw in the Dell dbutil driver, to plant a Windows rootkit ^[13]. In February, Mandiant and the Google Threat Intelligence Group reported that suspected Chinese spies tracked as UNC6201 had exploited CVE-2026-22769, a hardcoded credential in Dell RecoverPoint for Virtual Machines, since at least mid-2024 ^[14]. The group used it to create hidden network interfaces on VMware ESXi servers and deploy malware ^[14]. The researchers found overlaps between UNC6201 and Silk Typhoon, a group linked to the Zipline and Spawnant malware seen in attacks exploiting Ivanti zero-days ^[15]. A few days after that, CISA gave federal agencies three days to patch their vulnerable Dell systems ^[16].

Those are two actors working two different products ^[13][14]. Together they show sustained interest in Dell's enterprise software. In the RecoverPoint case the flaw was in use from at least mid-2024 until the February report ^[14]. In my view that history, together with three remote code execution paths in a single tool, justifies moving DSU 2.3.0.0 ahead of the next maintenance window ^[11].