InfoSecBulletin Cybersecurity for mankind
A critical flaw with how Dell saves BIOS passwords lets anyone quickly recover these passwords from a flash dump without guessing. The flaw, known as CVE-2026-40639 (DSA-2026-197), comes from a faulty XOR encryption method instead of a real cryptographic hash.
Dell keeps BIOS passwords in a special area of the SPI flash chip called DVAR. These passwords are locked with a 20-byte XOR key applied to a 32-byte space. The first letter of the password is saved without any encryption.
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
Thousands of MCP Servers Exposed to File Access and Injection Attacks
For a password that is 12 characters or less, the extra part of the 32-byte field is X-Or’d with zero, showing the key bytes clearly. The key is 20 bytes, but the field is 32 bytes, so this gap exposes the whole key from the record, allowing attackers to figure out the password right away.
Longer passwords have a small weak spot, but the researchers discovered a solution: Dell’s method uses just one fixed seed for each device, a GUID, and the first character of the password, which is not encrypted.
Researchers told Dell about the problem in March 2026. Dell confirmed the results and released DSA-2026-197 on June 9, 2026. This update fixed some devices (Edge Gateway, Embedded PC, Precision, and Rugged Latitude). More fixes are planned for the end of July 2026. However, the advisory does not include the Wyse 5070 or other known vulnerable devices.
The researchers and Dell have a small difference in CVSS scores: Dell gives it 5.7, but the researchers say it should be 6.1, because they see Attack Complexity.
The researchers suggest Dell use salted, repeated password hashing everywhere and safely delete old DVAR records. They also tell defenders not to depend only on BIOS passwords to keep encrypted boot chains safe.
Zimbra urges customers to patch
Zimbra is asking customers to update their systems to fix a serious security issue in the Classic Web Client that could allow harmful code to run.
The vulnerability is a type of stored cross-site scripting (XSS). It could let bad emails run harmful scripts in a user’s session. It does not have a CVE identifier yet.
“The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened,” Zimbra said. “If exploited, it could allow access to mailbox information, session data, or account settings.”
Zimbra does not say that the vulnerability has been used in real attacks, but XSS problems in Zimbra have been targeted by hackers for years, with bad actors trying to use these issues as early as December 2021.
The company launched Zimbra 10.1.19 this Tuesday to fix a security flaw called cross-site scripting (XSS). This issue doesn’t have a CVE ID yet for tracking. Bad actors can misuse this Classic Web Client problem using special emails that run harmful code when opened.
“Any customer using the Classic Web Client should upgrade to ZCS v10.1.19 as soon as possible, as this issue only impacts the users of Classic Web Client,” Zimbra warned. “We strongly recommend upgrading to this version to keep your environment secure.”
