Secure Connect Gateway CVE-2026-61409

No authentication is required - the CVSS vector PR:N confirms unauthenticated exploitation is possible. The attacker must have network access to the SCG application interface (AV:N, AC:L). Both the SCG 5.0 Application software deployment and the SCG 5.0 Appliance hardware form factor are affected. The specific vulnerable input parameter or endpoint is not disclosed in the advisory. Exploitation is limited to SCG 5.0 instances running versions prior to 5.36.00.00; organizations not running Dell SCG 5.0 in their environment are not affected. The vendor's C:L/I:L/A:L rating suggests possible execution context constraints that may limit post-exploitation capability, but the nature of those constraints is unconfirmed.

The CVSS vector AV:N/AC:L/PR:N/UI:N signals low-friction, unauthenticated, network-reachable exploitation with no user interaction - a strong attacker-favoring profile. However, the vendor-assigned impact metrics C:L/I:L/A:L yield a base score of 7.3, which is notably low for OS command injection; typical CWE-78 findings are rated C:H/I:H/A:H (9.8) unless the execution context is meaningfully constrained (e.g., a sandboxed subprocess, restricted shell, or limited-output endpoint). This discrepancy is not explained in the advisory and should be verified with Dell - it is possible the injected command runs in a restricted service account or container, limiting blast radius, but this is inferred rather than confirmed. No EPSS data, KEV listing, or public POC was provided, so empirical exploitation probability is unknown. Organizations with SCG deployments should treat this as a high-priority patch given the PR:N/AV:N vector, even if the vendor's C:L/I:L/A:L assessment is accurate.

An unauthenticated remote attacker identifies a Dell SCG 5.0 instance exposed on the network and sends a crafted HTTP request (or other applicable protocol payload) containing shell metacharacters to a vulnerable input parameter. The application passes the unsanitized input to a system() or equivalent call, executing attacker-controlled OS commands in the context of the SCG service process. The attacker gains at minimum partial read/write access to the system, with the full scope depending on the service account privileges under which SCG runs.