CVE-2026-71168 is a high severity (CVSS 7.3) path traversal in Dell System Update (DSU) versions before 2.3.0.0. A low privileged local attacker could exploit it, and the record says the result could be remote execution. The fix is to move to version 2.3.0.0 or later.
What's affected
Dell System Update versions prior to 2.3.0.0, per the record. I could not fetch the Dell advisory (DSA-2026-324), so I cannot confirm more.
The weakness is CWE-22: improper limitation of a pathname to a restricted directory. The vector is AV:L/AC:L/PR:L/UI:R: local access, low complexity, low privileges and a user action required. Confidentiality, integrity and availability impacts are all high.
DSU is a tool administrators run to apply Dell driver and firmware updates, so it often runs with elevated rights on servers.
How to check if you're exposed
Dell's advisory page returned an access denied error when I tried to fetch it, so the version below comes from the CVE record only. Read the advisory in a browser before you act on it.
Find the DSU version on each machine. On Linux:
dsu --version
On Windows, check the installed programs list for Dell System Update and read the version. Compare with 2.3.0.0.
DSU is often installed once and left, so older copies linger on servers that no one thinks about. Use your configuration management or endpoint inventory to list every host with the package installed.
free in-browser dependency scan checks dependencies in your own applications, not installed vendor tools.
What to do now
- Read Dell advisory DSA-2026-324 in a browser and confirm the fixed version.
- List every host that has Dell System Update installed.
- Upgrade DSU to 2.3.0.0 or later through Dell's download or your package repository.
- Limit local logins on servers where DSU runs to the people who need them.
- Add DSU to your regular patch inventory so it is not forgotten again.
Why it matters
CWE-22 means a program builds a file path from input and does not stop the input from pointing outside the intended folder. When the program runs with high rights, writing or reading outside the folder can lead to code running as that higher privileged user, which fits the record's remote execution wording.
The local and user action requirements lower the score. Even so, update tools matter because they run as administrators by design and are trusted by the people who use them. Treat them like any other privileged software in your patch process.
Quick check
Does the attacker need to be on the machine?
The vector is local, so yes, the attacker needs local access with low privileges and a user action. That is why limiting local logins reduces risk.
Sources
Last reviewed: 18 October 2026.
