Dell warns of critical flaw in system update tool that lets hackers gain full control
Dell has issued an urgent warning about a critical vulnerability in its System Update tool that could allow hackers to take complete control of your servers and workstations, according to BleepingComputer. The company is urging customers to patch the flaw as soon as possible.
Dell has issued an urgent warning about a critical vulnerability in its System Update tool that could allow hackers to take complete control of your servers and workstations, according to BleepingComputer. The company is urging customers to patch the flaw as soon as possible.
The issue, tracked as CVE-2026-86360, is a path traversal weakness in the Dell System Update command-line interface. This tool is used by IT administrators to deploy BIOS and firmware updates on PowerEdge servers and other devices. Dell says an unauthenticated attacker with remote access can exploit this to execute code with root privileges, effectively gaining full control of the underlying operating system.
Dell also patched four other high-severity flaws in the same tool. Two allow remote code execution, and two enable privilege escalation. Additionally, the company urged IT admins to patch two maximum-severity vulnerabilities in its Container Storage Modules. Dell recommends upgrading System Update to version 2.3.0.0 or later to fix these issues.
While Dell hasn’t flagged these specific flaws as actively exploited, the FBI and CISA have long warned that path traversal weaknesses are ‘unforgivable.’ State-backed groups like North Korea’s Lazarus and suspected Chinese cyber spies have previously abused Dell vulnerabilities to deploy malware. CISA even ordered federal agencies to patch related Dell systems within three days. (FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA), Mandiant and the Google Threat Intelligence Group (GTIG))
If your business uses Dell PowerEdge servers or workstations, here’s what you need to do this week. First, check if your office manager or IT provider uses Dell System Update for maintenance. If they do, ask them to ensure the tool is upgraded to version 2.3.0.0 or later. It’s a quick fix, and it stops attackers from walking through the front door.
Most small offices won’t have a server room, but if you do, this is the one you can’t ignore. The alarming part isn’t just the flaw itself, but how Dell’s update tool—a trusted utility—can be turned against you. Patch it now, and sleep better tonight.
Sources: BleepingComputer.
