CVE-2026-86360 Path traversal in System Update
Unauthenticated remote attackers can exploit a path traversal flaw in Dell System Update to execute arbitrary code with root privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-86360?
CVE-2026-86360 is a critical path traversal vulnerability in Dell System Update, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This vulnerability is considered critical because it can be leveraged by an unauthenticated attacker to execute arbitrary code with root privileges. Successful exploitation may allow complete compromise of the vulnerable application and underlying operating system. Dell recommends customers upgrade at the earliest opportunity.
Weakness: CWE-22
Which versions are affected by CVE-2026-86360?
It affects 1 product.
Products include Dell System Update.
How do I fix CVE-2026-86360?
No fix has been published for CVE-2026-86360 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-86360 being exploited?
There is no known exploitation of CVE-2026-86360 in the wild and no public exploit code.
Other vulnerabilities in Dell System Update
Sources
Also known as GHSA-rf34-rm6m-qwp4.