Loading story…
SentinelLabs reported that CVE-2021-21551 affected a Dell BIOS update driver preinstalled on a vast number of consumer and enterprise systems, exposing potentially hundreds of millions of computers to local privilege escalation. The issue involved multiple flaws in the dbutil driver, which could allow an attacker with local access to escalate privileges to kernel mode, bypass security controls, and execute arbitrary code at the highest level of the operating system.
Because the vulnerable driver was broadly distributed through Dell firmware update utilities and support tools, the exposure spanned many device models and persisted even after software updates in some environments. The report warned that successful exploitation could enable attackers to disable security products, maintain persistence, and gain deep control over affected endpoints, prompting the need for driver removal, vendor patches, and verification that vulnerable components were fully remediated across fleets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Dell issued a security advisory and remediation steps for CVE-2021-21551, including an updated driver and instructions for removing the vulnerable dbutil component from affected systems. The response addressed the risk of abuse by local attackers leveraging the flawed driver.
Multiple privilege-escalation vulnerabilities in Dell's dbutil BIOS update driver were publicly disclosed under CVE-2021-21551, exposing hundreds of millions of Dell systems to local escalation and related attacks. The disclosure identified the driver as broadly present across consumer and enterprise devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourcedocs.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dell disclosed and researchers detailed **CVE-2026-40639** (`DSA-2026-197`), a BIOS password storage weakness that allows administrator and user passwords to be recovered from SPI flash dumps in milliseconds on affected Dell client platforms. The flaw affects the `SystemPwSmm` SMM driver and stems from storing password records in the DVAR region with a reversible repeating 20-byte XOR scheme over a 32-byte field, while leaving the first password character unencrypted. For passwords of 12 characters or fewer, leaked key material is sufficient for deterministic recovery without brute force; researchers also reported that longer passwords are often recoverable because deleted DVAR records are not securely erased and key derivation is limited by device-specific values. Confirmed vulnerable systems include the **Wyse 5070** thin client and reported examples such as the **Latitude E7250**, **Latitude 7490**, and **XPS 15 9560**, although some newer Dell platforms were found to use stronger protections and were not affected. The attack requires physical access to read SPI flash or the ability to boot an attacker-controlled OS, but recovered BIOS credentials could let an attacker change settings tied to **Secure Boot**, boot order, and pre-boot DMA controls, potentially weakening some full-disk encryption assumptions. Dell validated the report after private disclosure, issued patches for some product lines, and said additional fixes were planned, though some confirmed vulnerable devices remained unpatched at publication time.
Jul 13, 2026
Dell disclosed multiple high-severity vulnerabilities affecting enterprise storage and backup platforms, including **PowerProtect Data Domain**, **Storage Manager**, and **Unity**. In PowerProtect Data Domain, **CVE-2026-26944** allows unauthenticated remote attackers to reach a privileged function and potentially execute commands as `root` if a legitimate user performs a specific action, while **CVE-2026-26943** and **CVE-2026-23778** enable root-level command execution for attackers with high privileges. Dell said the issues affect several DD OS release tracks, Data Domain Virtual Edition, APEX Protection Storage, Data Domain Management Center, and PowerProtect DP Series appliances, and released fixes through advisory **DSA-2026-060**, adding that it had no indication of active exploitation. Dell also issued critical updates for other storage lines. **Dell Storage Manager** vulnerabilities **CVE-2025-43994** and **CVE-2025-43995** expose management functions and APIs to unauthenticated remote access or authentication bypass, potentially affecting all storage arrays managed by a vulnerable instance; Dell’s advisory **DSA-2025-393** recommends upgrading to **2020 R1.22** or later. In **Dell Unity**, **CVE-2025-36604** permits unauthenticated remote OS command injection, while **CVE-2025-36606** and **CVE-2025-36607** allow authenticated attackers to escape restricted utilities and run commands as `root`; Dell remediated those flaws in **Unity OE 5.5.1** and later. The disclosures highlight elevated risk to backup integrity, storage administration, and ransomware recovery operations if exposed management interfaces remain unpatched.
Jun 29, 2026
Microsoft disclosed multiple Windows local privilege escalation vulnerabilities affecting kernel-level drivers, including **Windows Common Log File System (CLFS) Driver** flaws tracked as `CVE-2023-23376` and `CVE-2023-28252`, as well as a **Windows Cloud Files Mini Filter Driver** flaw tracked as `CVE-2025-62454`. All three issues were classified as **Elevation of Privilege** vulnerabilities in Microsoft's Security Update Guide. The advisories indicate that successful exploitation could allow an attacker who already has access to a target system to gain higher privileges through vulnerable Windows driver components. The affected bugs span separate Windows subsystems but share the same core risk: attackers can abuse low-level driver weaknesses to move from limited access toward more powerful control over compromised machines, reinforcing the need to prioritize Microsoft security updates for Windows kernel and file-system-related components.
Jul 12, 2026