What’s Vulnerable › Vulnerabilities

CVE-2026-40639

• Severity: medium (CVSS 5.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-09 · updated 2026-07-23
• Weakness: CWE-261

Description

Dell Client Platform BIOS contains a Weak Encoding for Password vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Elevation of Privileges.

Affected products

• Dell Edge Gateway 3000: before 1.26.0 — fixed in 1.26.0
• Dell Edge Gateway 5000: before 1.36.0 — fixed in 1.36.0
• DELL EMBEDDED PC 3000: before 1.32.0 — fixed in 1.32.0
• DELL EMBEDDED PC 5000: before 1.33.0 — fixed in 1.33.0
• Dell Precision 3630 Tower: before 2.40.0 — fixed in 2.40.0
• Dell Precision 3930 Rack: before 2.43.0 — fixed in 2.43.0
• Dell Latitude 7220 Rugged Extreme: before 1.51.0 — fixed in 1.51.0
• Dell Latitude Rugged 5420: before 1.42.0 — fixed in 1.42.0
• Dell Latitude Rugged 5424: before 1.42.0 — fixed in 1.42.0
• Dell Latitude Rugged 7220EX: before 1.51.0 — fixed in 1.51.0
• Dell Latitude Rugged 7424: before 1.42.0 — fixed in 1.42.0
• Dell Precision 3930 Rack: before 2.43.0 — fixed in 2.43.0

How to fix

Upgrade to a fixed version: Dell Edge Gateway 3000 1.26.0; Dell Edge Gateway 5000 1.36.0; DELL EMBEDDED PC 3000 1.32.0; DELL EMBEDDED PC 5000 1.33.0; Dell Precision 3630 Tower 2.40.0; Dell Precision 3930 Rack 2.43.0; Dell Latitude 7220 Rugged Extreme 1.51.0; Dell Latitude Rugged 5420 1.42.0; Dell Latitude Rugged 5424 1.42.0; Dell Latitude Rugged 7220EX 1.51.0; Dell Latitude Rugged 7424 1.42.0; Dell Precision 3930 Rack 2.43.0. Check the vendor advisory for mitigations.

References

• https://www.dell.com/support/kbdoc/en-us/000453482/dsa-2026-197

Get alerted when CVE-2026-40639 or the next vulnerability affects your stack