InfoSecBulletin Cybersecurity for mankind
A critical flaw with how Dell saves BIOS passwords lets anyone quickly recover these passwords from a flash dump without guessing. The flaw, known as CVE-2026-40639 (DSA-2026-197), comes from a faulty XOR encryption method instead of a real cryptographic hash.
Dell keeps BIOS passwords in a special area of the SPI flash chip called DVAR. These passwords are locked with a 20-byte XOR key applied to a 32-byte space. The first letter of the password is saved without any encryption.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
For a password that is 12 characters or less, the extra part of the 32-byte field is X-Or’d with zero, showing the key bytes clearly. The key is 20 bytes, but the field is 32 bytes, so this gap exposes the whole key from the record, allowing attackers to figure out the password right away.
Longer passwords have a small weak spot, but the researchers discovered a solution: Dell’s method uses just one fixed seed for each device, a GUID, and the first character of the password, which is not encrypted.
Researchers told Dell about the problem in March 2026. Dell confirmed the results and released DSA-2026-197 on June 9, 2026. This update fixed some devices (Edge Gateway, Embedded PC, Precision, and Rugged Latitude). More fixes are planned for the end of July 2026. However, the advisory does not include the Wyse 5070 or other known vulnerable devices.
The researchers and Dell have a small difference in CVSS scores: Dell gives it 5.7, but the researchers say it should be 6.1, because they see Attack Complexity.
The researchers suggest Dell use salted, repeated password hashing everywhere and safely delete old DVAR records. They also tell defenders not to depend only on BIOS passwords to keep encrypted boot chains safe.
Zimbra urges customers to patch
Zimbra is asking customers to update their systems to fix a serious security issue in the Classic Web Client that could allow harmful code to run.
The vulnerability is a type of stored cross-site scripting (XSS). It could let bad emails run harmful scripts in a user’s session. It does not have a CVE identifier yet.
“The update fixes a security issue in the Classic Web Client where a specially crafted email could run malicious code when the email is opened,” Zimbra said. “If exploited, it could allow access to mailbox information, session data, or account settings.”
Zimbra does not say that the vulnerability has been used in real attacks, but XSS problems in Zimbra have been targeted by hackers for years, with bad actors trying to use these issues as early as December 2021.
The company launched Zimbra 10.1.19 this Tuesday to fix a security flaw called cross-site scripting (XSS). This issue doesn’t have a CVE ID yet for tracking. Bad actors can misuse this Classic Web Client problem using special emails that run harmful code when opened.
“Any customer using the Classic Web Client should upgrade to ZCS v10.1.19 as soon as possible, as this issue only impacts the users of Classic Web Client,” Zimbra warned. “We strongly recommend upgrading to this version to keep your environment secure.”
