Read the docs
TI-2026-68547 Aliases CVE-2026-86360GHSA-rf34-rm6m-qwp4

Path traversal in Dell System Update allows remote filesystem access

Priority MEDIUM 44CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Dell System Update versions prior to 2.3.0.0 are affected. A path traversal flaw (CWE-22) lets a remote attacker reach files outside the intended directory. An unauthenticated attacker can gain filesystem access and, according to Dell, execute arbitrary code with root privileges, though exploitation requires user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This vulnerability is considered critical because it can be leveraged by an unauthenticated attacker to execute arbitrary code with root privileges. Successful exploitation may allow complete compromise of the vulnerable application and underlying operating system. Dell recommends customers upgrade at the earliest opportunity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00598 48th percentileScored 2026-11-07
Fix Fixed System Update (Dell): 2.3.0.0 or later

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellSystem Updatebefore 2.3.0.0 or later2.3.0.0 or laterPatch availableCNA
  • System Update VendorDell Affected before 2.3.0.0 or later Fixed in 2.3.0.0 or later Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dell:system_update:*:*:*:*:*:*:*:*before 2.3.0.0VulnerableDell
  • cpe:2.3:a:dell:system_update:*:*:*:*:*:*:*:* Versions before 2.3.0.0 Vulnerable ·Dell

Remediation

Upgrade Dell System Update to version 2.3.0.0 or later, which Dell recommends at the earliest opportunity.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA System Update (Dell) Fixed in 2.3.0.0 or later

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Dell System Update — dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-securit…

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-68549 Access control flaw in Dell System Update allows privilege escalationPriority LOW 37
    • TI-2026-68548 Dell System Update flaw lets local users escalate privilegesPriority LOW 37
    • TI-2026-68504 Path traversal in Dell System Update enables remote executionPriority LOW 35
    Show all 5 records → Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-86360
  2. 2026-10-07 CISA SSVC decision points changed
  3. 2026-10-07 Alias added: GHSA-rf34-rm6m-qwp4

References

Patch 1

  • TI-2026-68549 Access control flaw in Dell System Update allows privilege escalation CVSS 3.1HIGH 8.2
  • TI-2026-68548 Dell System Update flaw lets local users escalate privileges CVSS 3.1HIGH 8.2
  • TI-2026-68504 Path traversal in Dell System Update enables remote execution CVSS 3.1HIGH 7.8
  • TI-2026-68500 Improper certificate validation in Dell System Update CVSS 3.1HIGH 7.6
  • TI-2022-15302 Improper certificate validation in Dell System Update CVSS 3.1MEDIUM 6.5
  • TI-2021-04614 Uncontrolled resource consumption in DellEMC System Update - DSU CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences