CVE-2026-35159
MEDIUMCVSS 5.3/10EPSS 0.16%
Last modified
CVE-2026-35159 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.
Metrics
CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Dell | Inspiron 15 3520 | < 1.41.0 or later |
| Dell | G15 5530 | < 1.33.0 or later |
| Dell | Alienware 16 Area-51 AA16250 | < 2.4.1 or later |
| Dell | Alienware 16 Aurora AC16250 | < 1.13.0 or later |
| Dell | Alienware 16X Aurora AC16251 | < 2.4.0 or later |
| Dell | Alienware 18 Area-51 AA18250 | < 2.4.1 or later |
| Dell | Alienware Area-51 AAT2250 | < 1.17.2 or later |
| Dell | Alienware Aurora ACT1250 | < 1.16.2 or later |
| Dell | Alienware m15 R6 | < 1.44.0 or later |
| Dell | Alienware m15 R7 | < 1.40.0 or later |
| Dell | Alienware m16 R1 | < 1.34.0 or later |
| Dell | Alienware m16 R2 | < 1.21.0 or later |
| Dell | Alienware m18 R1 | < 1.34.0 or later |
| Dell | Alienware M18 R2 | < 1.22.0 or later |
| Dell | Alienware x14 R2 | < 1.32.0 or later |
| Dell | Alienware x16 R1 | < 1.32.0 or later |
| Dell | Alienware X16 R2 | < 1.22.0 or later |
| Dell | ChengMing 3900 | < 1.40.0 or later |
| Dell | ChengMing 3910/3911 | < 1.36.0 or later |
| Dell | Dell 14 DC14250 | < 1.7.0 or later |
| Dell | 14 Plus 2-in-1 DB04250 | < 1.13.0 or later |
| Dell | 14 Plus DB14250 | < 1.13.0 or later |
| Dell | 15 DC15250 | < 1.10.0 or later |
| Dell | 16 Plus 2-in-1 DB06250 | < 1.13.0 or later |
| Dell | 16 Plus DB16250 | < 1.13.0 or later |
| Dell | 24 All-in-One EC24250 | < 1.15.0 or later |
| Dell | 27 All-in-One EC27250 | < 1.15.0 or later |
| Dell | G15 5510 | < 1.40.0 or later |
| Dell | G15 5511 | < 1.43.0 or later |
| Dell | G15 5520 | < 1.41.0 or later |
| Dell | G16 7620 | < 1.41.0 or later |
| Dell | G16 7630 | < 1.33.0 or later |
| Dell | Pro 13 Plus PB13250 | < 2.13.4 or later |
| Dell | Pro 13 Plus PB13255 | < 1.15.0 or later |
| Dell | Pro 13 Premium PA13250 | < 2.13.4 or later |
| Dell | Pro 14 Essential PV14250 | < 1.6.0 or later |
| Dell | Pro 14 PC14250 | < 1.15.2 or later |
| Dell | Pro 14 Plus PB14250 | < 2.13.4 or later |
| Dell | Pro 14 Plus PB14255 | < 1.15.0 or later |
| Dell | Pro 14 Premium PA14250 | < 2.13.4 or later |
| Dell | Pro 16 PC16250 | < 1.15.2 or later |
| Dell | Pro 16 Plus PB16250 | < 2.13.4 or later |
| Dell | Pro 16 Plus PB16255 | < 1.15.0 or later |
| Dell | Pro 24 All-In-One Plus QB24250 / Pro 24 All-In-One QC24250 / Pro 24 All-In-One QC24251 | < 1.15.1 or later |
| Dell | Pro Laptop PC14250 | < 1.15.2 or later |
| Dell | Pro Laptop PC16250 | < 1.15.2 or later |
| Dell | Pro Max 14 MC14250 | < 1.14.1 or later |
| Dell | Pro Max 14 MC14255 | < 2.4.0 or later |
| Dell | Pro Max 16 MC16250 | < 1.14.1 or later |
| Dell | Pro Max 16 MC16255 | < 2.4.0 or later |
Showing 50 of 230 affected configurations. See the CNA advisory for the full list.
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-35159?
Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure.
How severe is CVE-2026-35159?
CVE-2026-35159 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 0.16% probability of exploitation in the next 30 days.
How do I fix CVE-2026-35159?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-3515A vulnerability in the `GitHubRepository` block of the `pref…8.5
- CVE-2026-35152A SQL Injection vulnerability exists in Apache Fineract's Re…8.8
- CVE-2026-35153Dell PowerProtect Data Domain Feature Release versions 7.7.1…6.7
- CVE-2026-35154Dell PowerProtect Data Domain Feature Release versions 7.7.1…6.7
- CVE-2026-35155Dell iDRAC10, versions 1.20.70.50 and 1.30.05.10, contains a…7.1
- CVE-2026-35157Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectSca…9.8
- CVE-2026-3516The Contact List plugin for WordPress is vulnerable to Store…6.4
- CVE-2026-35162Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain…6.5
- CVE-2026-35164Brave CMS is an open-source CMS. Prior to 2.0.6, an unrestri…8.8
- CVE-2026-35165LORIS (Longitudinal Online Research and Imaging System) is a…6.5
- CVE-2026-35166Hugo is a static site generator. From 0.60.0 to before 0.159…5.4
- CVE-2026-35167Kedro is a toolbox for production-ready data science. Prior …8.1
Are you affected by CVE-2026-35159?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST