Secure Connect Gateway CVE-2026-27101

The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) indicates network accessibility with low attack complexity but high privilege requirements; this significantly constrains real-world exploitability despite the network attack vector. The CVSS score of 4.7 reflects moderate severity with limited confidentiality, integrity, and availability impact. The critical limiting factor is PR:H (high privileges required), meaning an attacker must already possess administrative or equivalent credentials within the management network-this substantially reduces the threat surface compared to unauthenticated vulnerabilities. No EPSS probability, CISA KEV confirmation, or public proof-of-concept has been identified in the provided data, further suggesting this is a lower real-world priority than the CVSS score alone might indicate. Organizations should prioritize patching based on their management network security posture and whether untrusted administrators have access.

A disgruntled system administrator or insider threat with high-level credentials on the SCG management network could craft a malicious request containing path traversal sequences to escape the application's intended file restrictions, read sensitive configuration files (affecting confidentiality), modify system files (affecting integrity), or write to executable locations to achieve remote code execution. However, the attacker must already possess legitimate high-level access to the management network, significantly limiting the attack surface to insider or compromised-credential scenarios rather than external threats.