Dell identified a critical BIOS vulnerability, tracked as CVE-2026-40639, that allows attackers to recover administrator and user passwords in milliseconds. The flaw originates from a broken XOR encryption scheme within physical SPI flash dumps. Exploitation requires physical access but no authentication.
The vulnerability enables attackers to disable security features such as Secure Boot. This process potentially allows unauthorized users to bypass full-disk encryption.
Dell received private notification of the flaw in March 2026. The company issued an initial patch, DSA-2026-197, on June 9, 2026. This update currently covers specific Edge Gateway, Precision, and Latitude models.
Several confirmed vulnerable devices, including the Wyse 5070 thin client, remain unpatched. Dell expects to release broader security fixes by the end of July 2026.