Loading story…
Dell disclosed and researchers detailed CVE-2026-40639 (DSA-2026-197), a BIOS password storage weakness that allows administrator and user passwords to be recovered from SPI flash dumps in milliseconds on affected Dell client platforms. The flaw affects the SystemPwSmm SMM driver and stems from storing password records in the DVAR region with a reversible repeating 20-byte XOR scheme over a 32-byte field, while leaving the first password character unencrypted. For passwords of 12 characters or fewer, leaked key material is sufficient for deterministic recovery without brute force; researchers also reported that longer passwords are often recoverable because deleted DVAR records are not securely erased and key derivation is limited by device-specific values.
Confirmed vulnerable systems include the Wyse 5070 thin client and reported examples such as the Latitude E7250, Latitude 7490, and XPS 15 9560, although some newer Dell platforms were found to use stronger protections and were not affected. The attack requires physical access to read SPI flash or the ability to boot an attacker-controlled OS, but recovered BIOS credentials could let an attacker change settings tied to Secure Boot, boot order, and pre-boot DMA controls, potentially weakening some full-disk encryption assumptions. Dell validated the report after private disclosure, issued patches for some product lines, and said additional fixes were planned, though some confirmed vulnerable devices remained unpatched at publication time.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
One report stated Dell planned further patches for additional affected platforms by the end of July 2026. This followed the June 9 initial advisory and patch release, which did not yet cover all confirmed vulnerable devices.
MDSec and AmberWolf researchers publicly disclosed that Dell BIOS passwords could be deterministically recovered from SPI flash because of a reversible repeating-key XOR scheme and leaked key material in DVAR records. They reported confirmed impact on several Dell systems and said some vulnerable devices remained unpatched at publication time.
Dell published advisory DSA-2026-197 for CVE-2026-40639 and issued patches for some affected platform lines. Multiple reports note that several confirmed vulnerable systems were still not covered by the initial fixes.
The CVE-2026-40639 BIOS password recovery issue was privately disclosed to Dell, which later validated the report. The flaw affects Dell's storage of BIOS administrator and user passwords in SPI flash.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcemdsec.co.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelLabs reported that **CVE-2021-21551** affected a Dell BIOS update driver preinstalled on a vast number of consumer and enterprise systems, exposing potentially **hundreds of millions of computers** to local privilege escalation. The issue involved multiple flaws in the `dbutil` driver, which could allow an attacker with local access to escalate privileges to kernel mode, bypass security controls, and execute arbitrary code at the highest level of the operating system. Because the vulnerable driver was broadly distributed through Dell firmware update utilities and support tools, the exposure spanned many device models and persisted even after software updates in some environments. The report warned that successful exploitation could enable attackers to disable security products, maintain persistence, and gain deep control over affected endpoints, prompting the need for driver removal, vendor patches, and verification that vulnerable components were fully remediated across fleets.
Jul 12, 2026
Dell disclosed two high-severity vulnerabilities in **PowerProtect Data Domain** appliances running multiple **DD OS** releases, including a weak-credentials flaw tracked as `CVE-2026-23853` and a missing-authentication issue tracked as `CVE-2026-26944`. The weak-credentials vulnerability affects Feature Release versions **7.7.1.0 through 8.5**, **LTS2025 8.3.1.0 through 8.3.1.20**, and **LTS2024 7.13.1.0 through 7.13.1.50**, and could allow an unauthenticated attacker with local access to gain unauthorized access to the system. The issue is classified as **CWE-1391** and carries a **CVSS v3.1** score vector of `AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. Dell also reported `CVE-2026-26944`, a **missing authentication for critical function** flaw classified as **CWE-306**, which could allow an unauthenticated remote attacker to execute arbitrary commands with **root privileges** if an authenticated user performs a specific action. That vulnerability is rated with the **CVSS v3.1** vector `AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`. Both issues were referenced in Dell security guidance, including advisory **`DSA-2026-060`**, and affect backup infrastructure that may be critical to recovery operations, making remediation and version review a priority for defenders.
Jun 29, 2026
Dell disclosed multiple high-severity vulnerabilities affecting enterprise storage and backup platforms, including **PowerProtect Data Domain**, **Storage Manager**, and **Unity**. In PowerProtect Data Domain, **CVE-2026-26944** allows unauthenticated remote attackers to reach a privileged function and potentially execute commands as `root` if a legitimate user performs a specific action, while **CVE-2026-26943** and **CVE-2026-23778** enable root-level command execution for attackers with high privileges. Dell said the issues affect several DD OS release tracks, Data Domain Virtual Edition, APEX Protection Storage, Data Domain Management Center, and PowerProtect DP Series appliances, and released fixes through advisory **DSA-2026-060**, adding that it had no indication of active exploitation. Dell also issued critical updates for other storage lines. **Dell Storage Manager** vulnerabilities **CVE-2025-43994** and **CVE-2025-43995** expose management functions and APIs to unauthenticated remote access or authentication bypass, potentially affecting all storage arrays managed by a vulnerable instance; Dell’s advisory **DSA-2025-393** recommends upgrading to **2020 R1.22** or later. In **Dell Unity**, **CVE-2025-36604** permits unauthenticated remote OS command injection, while **CVE-2025-36606** and **CVE-2025-36607** allow authenticated attackers to escape restricted utilities and run commands as `root`; Dell remediated those flaws in **Unity OE 5.5.1** and later. The disclosures highlight elevated risk to backup integrity, storage administration, and ransomware recovery operations if exposed management interfaces remain unpatched.
Jun 29, 2026