Loading vulnerability…
CVE-2026-40639 is a weak password-encoding vulnerability in Dell Client Platform BIOS. Affected platforms store BIOS administrator and user passwords in the SPI-flash DVAR store using reversible repeating-key XOR encoding rather than a one-way password-verification design. The first password character is retained in cleartext, while null padding in the fixed-length password field can disclose sufficient XOR key material to deterministically recover passwords of 12 characters or fewer. Historical deleted password records may remain recoverable and can assist recovery of longer current passwords. The weakness has been confirmed on multiple Dell client platforms; newer platforms using different password-storage architectures are not affected.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability affecting Dell BIOS password protection in which weak XOR-based encryption allows recovery of BIOS passwords from SPI flash.
A critical Dell BIOS password storage vulnerability caused by a broken XOR-based scheme in DVAR records that allows recovery of BIOS administrator and user passwords from SPI flash dumps without brute force.
A Dell BIOS password storage flaw that allows recovery of administrator and user passwords from SPI flash due to broken XOR-based protection and key leakage in DVAR records.
A Dell Client Platform BIOS vulnerability in which BIOS passwords are reversibly stored in the DVAR SPI flash region using a weak repeating-key XOR scheme, allowing deterministic recovery of plaintext passwords from a flash dump and enabling full BIOS access for an attacker with physical access.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.