InfoSecBulletin Cybersecurity for mankind
A critical flaw with how Dell saves BIOS passwords lets anyone quickly recover these passwords from a flash dump without guessing. The flaw, known as CVE-2026-40639 (DSA-2026-197), comes from a faulty XOR encryption method instead of a real cryptographic hash.
Dell keeps BIOS passwords in a special area of the SPI flash chip called DVAR. These passwords are locked with a 20-byte XOR key applied to a 32-byte space. The first letter of the password is saved without any encryption.
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
For a password that is 12 characters or less, the extra part of the 32-byte field is X-Or’d with zero, showing the key bytes clearly. The key is 20 bytes, but the field is 32 bytes, so this gap exposes the whole key from the record, allowing attackers to figure out the password right away.
Longer passwords have a small weak spot, but the researchers discovered a solution: Dell’s method uses just one fixed seed for each device, a GUID, and the first character of the password, which is not encrypted.
Researchers told Dell about the problem in March 2026. Dell confirmed the results and released DSA-2026-197 on June 9, 2026. This update fixed some devices (Edge Gateway, Embedded PC, Precision, and Rugged Latitude). More fixes are planned for the end of July 2026. However, the advisory does not include the Wyse 5070 or other known vulnerable devices.
The researchers and Dell have a small difference in CVSS scores: Dell gives it 5.7, but the researchers say it should be 6.1, because they see Attack Complexity.
The researchers suggest Dell use salted, repeated password hashing everywhere and safely delete old DVAR records. They also tell defenders not to depend only on BIOS passwords to keep encrypted boot chains safe.
Zimbra urges customers to patch
Zimbra is asking customers to update their systems to fix a serious security issue in the Classic Web Client that could allow harmful code to run.
The vulnerability is a type of stored cross-site scripting (XSS). It could let bad emails run harmful scripts in a user’s session. It does not have a CVE identifier yet.
“The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened,” Zimbra said. “If exploited, it could allow access to mailbox information, session data, or account settings.”
Zimbra does not say that the vulnerability has been used in real attacks, but XSS problems in Zimbra have been targeted by hackers for years, with bad actors trying to use these issues as early as December 2021.
The company launched Zimbra 10.1.19 this Tuesday to fix a security flaw called cross-site scripting (XSS). This issue doesn’t have a CVE ID yet for tracking. Bad actors can misuse this Classic Web Client problem using special emails that run harmful code when opened.
“Any customer using the Classic Web Client should upgrade to ZCS v10.1.19 as soon as possible, as this issue only impacts the users of Classic Web Client,” Zimbra warned. “We strongly recommend upgrading to this version to keep your environment secure.”
