Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN971
_____________________________________________________________________

DATE                : 06/10/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Dell System Update (DSU)
                          versions prior to 2.3.0.0.
  
====================================================================
https://www.dell.com/support/kbdoc/en-us/000515843/dsa-2026-324-security-update-for-dell-system-update-dsu-vulnerabilities
_____________________________________________________________________

DSA-2026-324: Security update for Dell System Update (DSU)
Vulnerabilities

Summary: Dell System Update (DSU) remediation is available for
multiple security vulnerabilities that could be exploited by malicious
users to compromise the affected system


Impact

Critical


Details

Proprietary Code CVEs   Description   CVSS Base Score   CVSS Vector String

CVE-2026-86360

Dell System Update, versions prior to 2.3.0.0, contains an Improper
Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulnerability. An unauthenticated attacker with remote access could
potentially exploit this vulnerability, leading to Filesystem access
for attacker. This vulnerability is considered critical because it
can be leveraged by an unauthenticated attacker to execute arbitrary
code with root privileges. Successful exploitation may allow complete
compromise of the vulnerable application and underlying operating
system. Dell recommends customers upgrade at the earliest opportunity.
	
9.6

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HThis hyperlink is taking
you to a website outside of Dell Technologies.


CVE-2026-86361

Dell System Update, versions prior to 2.3.0.0, contains an Incorrect
Permission Assignment for Critical Resource vulnerability. A low
privileged attacker with local access could potentially exploit this
vulnerability, leading to Elevation of privileges.

8.2

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HThis hyperlink is taking
you to a website outside of Dell Technologies.


CVE-2026-86362

Dell System Update, versions prior to 2.3.0.0, contains an Improper
Access Control vulnerability. A low privileged attacker with local
access could potentially exploit this vulnerability, leading to
Elevation of privileges.

8.2

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HThis hyperlink is taking
you to a website outside of Dell Technologies.


CVE-2026-63697

Dell System Update, versions prior to 2.3.0.0, contains an Improper
Certificate Validation vulnerability. A high privileged attacker with
remote access could potentially exploit this vulnerability, leading
to Remote execution.

7.6

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:HThis hyperlink is taking
you to a website outside of Dell Technologies.


CVE-2026-71168
	
Dell System Update, versions prior to 2.3.0.0, contains an Improper
Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulnerability. A low privileged attacker with local access could
potentially exploit this vulnerability, leading to Remote execution.

7.3

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HThis hyperlink is taking
you to a website outside of Dell Technologies.


Dell Technologies recommends all customers consider both the CVSS
base score and any relevant temporal and environmental scores that
may impact the potential severity associated with a particular
security vulnerability.


Affected Products & Remediation

Product   Affected Versions   Remediated Versions   Link

Dell System Update (DSU)   Versions prior to 2.3.0.0
	Version 2.3.0.0 or later
https://www.dell.com/support/home/drivers/DriversDetails?driverid=J9TK1

 
Revision History

Revision               Date              Description

1.0                    2026-10-01        Initial Release

 

Acknowledgements

    CVE-2026-63697, CVE-2026-86360: Dell would like to thank Ori
Gabriel for reporting these issues.
    CVE-2026-86361, CVE-2026-86362: Dell would like to thank
saltedfish for reporting these issues.
    CVE-2026-71168: Dell would like to thank Nir Yehoshua of
Cipher Security Labs for reporting this issue.


Related Information

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Legal Disclaimer

Affected Products
Dell System Update


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================