Dell is urging customers to update its Dell System Update (DSU) tool following the disclosure of several security vulnerabilities, including a critical flaw that could allow an unauthenticated remote attacker to execute code with root privileges.
DSU is used to deploy BIOS, firmware, and software updates to Linux and Windows systems on Dell PowerEdge server infrastructure. Dell has released fixes and recommends upgrading to DSU version 2.3.0.0 or later.
For MSPs, the disclosure is a reminder that the tools used to maintain infrastructure also need to be part of a strong vulnerability management strategy.
Here are five takeaways for MSPs.
1. Prioritize the Critical DSU Vulnerability
The most serious vulnerability, CVE-2026-86360, is a path traversal flaw. According to Dell, an unauthenticated attacker with remote access could potentially exploit it to gain filesystem access and execute arbitrary code with root privileges.
The potential for root-level access makes timely remediation particularly important.
MSP Action: Identify client environments using Dell System Update and prioritize upgrading affected installations to DSU 2.3.0.0 or later.
2. Don’t Overlook the Additional DSU Flaws
Dell also addressed four high-severity vulnerabilities affecting DSU. Two could potentially allow remote attackers to achieve remote code execution, while two others could enable privilege escalation.
For MSPs, this reinforces the importance of reviewing all vulnerabilities covered by an update rather than focusing only on the highest-severity CVE.
MSP Action: Confirm that remediation addresses all affected DSU vulnerabilities rather than treating the critical flaw as an isolated issue.
3. Infrastructure Management Tools Need Security Attention
DSU helps organizations deploy BIOS, firmware, and software updates. The vulnerabilities demonstrate why the tools responsible for maintaining infrastructure must also be kept current.
Administrative and update utilities can sometimes receive less attention than operating systems or business applications, despite their important role within IT environments.
MSP Action: Include infrastructure management and update tools in regular software inventories, vulnerability reviews, and patching processes.
4. Visibility Helps MSPs Respond Faster
Effective remediation starts with knowing whether an affected product is present, where it is deployed, and which clients could be impacted.
This is especially important for MSPs supporting customers with different hardware, servers, and technology stacks. Strong asset visibility can make it easier to quickly determine where action is needed following a new vulnerability disclosure.
MSP Action: Maintain accurate inventories of infrastructure management tools and software versions across client environments.
5. Vendor Advisories Should Drive Timely Action
Dell recommends upgrading DSU at the earliest opportunity. At the time of the report, Dell had not indicated that these vulnerabilities were being actively exploited.
While that’s an important distinction, critical vulnerabilities still warrant attention before they become a larger risk.
MSP Action: Incorporate vendor security advisories into vulnerability management workflows and establish a process for escalating critical updates that require prompt action.
What MSPs Can Take Away
Security vulnerabilities are an ongoing reality across the technology ecosystem, and timely vendor fixes give IT teams an opportunity to reduce potential exposure.
For MSPs, the Dell System Update vulnerabilities reinforce the importance of asset visibility, monitoring vendor security guidance, and maintaining repeatable remediation processes.
The broader lesson isn’t about one vendor. It’s about ensuring that the tools MSPs and their clients depend on to maintain infrastructure are also inventoried, monitored, and updated. By combining strong visibility with timely action, MSPs can help keep client environments better protected.