CVE-2026-35159

MediumCVSS 5.3/10Last modified Jul 7, 2026

Description

Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
DellInspiron 15 3520< 1.41.0 or later
DellG15 5530< 1.33.0 or later
DellAlienware 16 Area-51 AA16250< 2.4.1 or later
DellAlienware 16 Aurora AC16250< 1.13.0 or later
DellAlienware 16X Aurora AC16251< 2.4.0 or later
DellAlienware 18 Area-51 AA18250< 2.4.1 or later
DellAlienware Area-51 AAT2250< 1.17.2 or later
DellAlienware Aurora ACT1250< 1.16.2 or later
DellAlienware m15 R6< 1.44.0 or later
DellAlienware m15 R7< 1.40.0 or later
DellAlienware m16 R1< 1.34.0 or later
DellAlienware m16 R2< 1.21.0 or later
DellAlienware m18 R1< 1.34.0 or later
DellAlienware M18 R2< 1.22.0 or later
DellAlienware x14 R2< 1.32.0 or later
DellAlienware x16 R1< 1.32.0 or later
DellAlienware X16 R2< 1.22.0 or later
DellChengMing 3900< 1.40.0 or later
DellChengMing 3910/3911< 1.36.0 or later
DellDell 14 DC14250< 1.7.0 or later
Dell14 Plus 2-in-1 DB04250< 1.13.0 or later
Dell14 Plus DB14250< 1.13.0 or later
Dell15 DC15250< 1.10.0 or later
Dell16 Plus 2-in-1 DB06250< 1.13.0 or later
Dell16 Plus DB16250< 1.13.0 or later
Dell24 All-in-One EC24250< 1.15.0 or later
Dell27 All-in-One EC27250< 1.15.0 or later
DellG15 5510< 1.40.0 or later
DellG15 5511< 1.43.0 or later
DellG15 5520< 1.41.0 or later
DellG16 7620< 1.41.0 or later
DellG16 7630< 1.33.0 or later
DellPro 13 Plus PB13250< 2.13.4 or later
DellPro 13 Plus PB13255< 1.15.0 or later
DellPro 13 Premium PA13250< 2.13.4 or later
DellPro 14 Essential PV14250< 1.6.0 or later
DellPro 14 PC14250< 1.15.2 or later
DellPro 14 Plus PB14250< 2.13.4 or later
DellPro 14 Plus PB14255< 1.15.0 or later
DellPro 14 Premium PA14250< 2.13.4 or later
DellPro 16 PC16250< 1.15.2 or later
DellPro 16 Plus PB16250< 2.13.4 or later
DellPro 16 Plus PB16255< 1.15.0 or later
DellPro 24 All-In-One Plus QB24250 / Pro 24 All-In-One QC24250 / Pro 24 All-In-One QC24251< 1.15.1 or later
DellPro Laptop PC14250< 1.15.2 or later
DellPro Laptop PC16250< 1.15.2 or later
DellPro Max 14 MC14250< 1.14.1 or later
DellPro Max 14 MC14255< 2.4.0 or later
DellPro Max 16 MC16250< 1.14.1 or later
DellPro Max 16 MC16255< 2.4.0 or later

References

Timeline

Published
Jul 3, 2026
Last modified
Jul 7, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-35166.4The Contact List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_cl_map_iframe' parameter in all versions up to,CVE-2026-351605.0Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command (CVE-2026-351615.3Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthenCVE-2026-351626.5Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Improper Access Control vulnerability. A low privileged attacker with remCVE-2026-351634.6OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, Suppressed Command notification popupCVE-2026-351648.8Brave CMS is an open-source CMS. Prior to 2.0.6, an unrestricted file upload vulnerability exists in the CKEditor upload functionality. It iCVE-2026-351656.5LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neurCVE-2026-351665.4Hugo is a static site generator. From 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not propeCVE-2026-351678.1Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() method in kedro/io/core.py constructs filesyCVE-2026-351688.8OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the Aggiornamenti (UpdCVE-2026-351695.4LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neurCVE-2026-35177.2OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an authenticated attacker with “Geo Administ
CVE-2026-35159: Medium severity, CVSS 5.3 | Vulnix