CVE-2026-63697 is a high severity (CVSS 7.6) improper certificate validation flaw in Dell System Update (DSU) before 2.3.0.0. A high privileged attacker with remote access could potentially achieve remote execution. Dell advisory DSA-2026-324 covers it, and the fix is DSU 2.3.0.0.
What's affected
The record says Dell System Update versions prior to 2.3.0.0. The weakness is CWE-295 (improper certificate validation). The record's description says a high privileged attacker with remote access could potentially exploit it, leading to remote execution.
The vector is network based, high complexity, high privileges required, with user interaction required and a changed scope. All three impacts are high. The attack conditions are demanding, which keeps the score below the critical band, but DSU is a tool that downloads and installs updates, so what it trusts matters.
The advisory is DSA-2026-324. Dell's support site requires a browser to view the advisory, so open the link in the sources and read the table of affected and remediated versions.
How to check if you're exposed
Find the DSU version on each Dell system.
Get-Package -Name "*System Update*" | Select-Object Name, Version
Any version below 2.3.0.0 is affected per the record. Your endpoint management tool probably has an installed software report that can list DSU by version across the fleet, which is faster than checking machines one by one.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- List every machine with Dell System Update installed, and its version.
- Update DSU to 2.3.0.0 or later using Dell's published package.
- Check Dell's advisory DSA-2026-324 for any other components that need updates on the same hosts.
- Restrict who has administrative rights on the machines that run DSU, since the attacker model needs high privileges.
- Make sure update traffic goes to Dell's official servers, or to an internal mirror you control.
Why it matters
Certificate validation is how a client confirms it is talking to the server it intended. If the check is incomplete, an attacker who can sit on the path or impersonate a host may supply content the client then trusts. For an update tool, trusted content can mean code that runs with high rights.
The weakness class is CWE-295. The score is limited by the need for high privileges, high complexity and user interaction. The record does not mark this CVE as exploited in the wild.
Quick check
Is a fix available?
The record says versions prior to 2.3.0.0 are affected, which indicates 2.3.0.0 is the fixed release. Confirm in Dell advisory DSA-2026-324.
Sources
Last reviewed: 18 October 2026.
