EUVD-2026-72364
GHSA-cc8p-8ffm-289j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SCG application over network
-
DeliverySend crafted request to privileged endpoint
-
ExploitBypass missing authorization check
-
ExecutionExecute arbitrary commands on gateway
-
ImpactPivot into connected infrastructure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Dell SCG 5.0 application/management interface and an affected version (Appliance <5.36.00.16 or Application <5.36.00.00). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are stated as prerequisites - the missing-authorization flaw is triggered by sending a crafted request that bypasses intended restrictions on code execution. The primary limiting factor is exposure: if the SCG interface is confined to an isolated management network, an external unauthenticated attacker cannot reach it, sharply reducing realistic risk. |
| Impact | This should be treated as a high-priority patch. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, and the described impact is remote command execution - a combination that is exactly the profile of a mass-exploitable enterprise-appliance bug once details or an exploit surface publicly. The high 9.4 score is consistent with the description; the vendor set A:L, which slightly understates a full-RCE outcome where an attacker could disrupt the host, so the true availability impact may be higher. Weighing the signals: patch is confirmed available, but there is no public POC and no CISA KEV listing, so exploitation is currently theoretical rather than observed - this tempers immediacy but not the underlying severity, because SCG sits in a trusted position bridging customer infrastructure to Dell. Any organization running SCG 5.0 with the management interface reachable should prioritize the upgrade; a mid-sized IT team with a single gateway is just as exposed as a large fleet because one unauthenticated request is sufficient. |
| Exploit ScenarioDerived | An attacker who can reach the SCG application over the network sends a single specially crafted request to a privileged endpoint that fails to check authorization, causing the gateway to execute attacker-supplied commands with no credentials or user interaction. Because SCG bridges customer infrastructure to Dell support, a compromised gateway offers a pivot point into the internal environment. No public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 07, 2026
Remote command execution in Dell Secure Connect Gateway 5.0 (Appliance versions before 5.36.00.16 and Application versions before 5.36.00.00) lets a remote, unauthenticated attacker run commands on the target by sending a specially crafted request that bypasses intended authorization checks. Dell has released fixed versions and the flaw is rated critical (CVSS 9.4). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: upgrade Dell SCG 5.0 Appliance to 5.36.00.16 or later and Dell SCG 5.0 Application to 5.36.00.00 or later, per Dell advisory DSA-2026-382 (https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities); Dell advises customers to upgrade at the earliest opportunity. As an interim compensating control until patching, restrict network access to the SCG management/application interface to only trusted management subnets via firewall or ACL, since the attack is network-reachable and unauthenticated - the trade-off is that overly broad restrictions can interrupt SCG's outbound support/telemetry connectivity to Dell, so scope rules to the specific inbound listeners rather than blanket-blocking the host. Monitor the gateway for anomalous requests to command-execution endpoints as a detective control.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dell Secure Connect Gateway (SCG) 5.0 Virtual Edition is Dell's enterprise remote-support and telemetry gateway that connects Dell infrastructure (servers, storage, networking) back to Dell support services. The affected CPEs are cpe:2.3:a:dell:secure_connect_gateway_5.0_-_application and cpe:2.3:a:dell:secure_connect_gateway_5.0_-_appliance, distinguishing the packaged appliance image from the application component. The root cause is CWE-862 (Missing Authorization): an application code path that performs a privileged action (command execution) does not verify the caller's authorization, so a request that should be rejected is honored. This is an authorization-check gap rather than a memory-corruption or injection-parsing bug, meaning the exploit primitive is reaching a normally-protected function without credentials.
Know when Secure Connect Gateway 5 0 Appliance gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Unauthenticated network-reachable command execution with no user interaction yields AV:N/AC:L/PR:N/UI:N; full RCE justifies C:H/I:H/A:H, slightly above the vendor's A:L.
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorization vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution. This vulnerability is considered critical because it allows an attacker to execute commands remotely on a target system by sending a specially crafted request to the application, bypassing intended restrictions on code execution.Dell recommends customers to upgrade at the earliest opportunity.
Executive ViewAI
Dell Secure Connect Gateway 5.0 contains a critical unauthenticated remote command execution vulnerability that allows attackers to bypass security controls and execute arbitrary commands on affected appliances. Organizations using this product for secure remote access face potential complete compromise of their remote connectivity infrastructure and unauthorized lateral movement into corporate networks. Immediate patching is required to close this access vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated remote attacker to escape the i
Unauthorized ADMIN access in Dell Secure Connect Gateway (SCG) 5.0 allows a remote unauthenticated attacker to replay a
Unauthorized remote access to Dell Secure Connect Gateway (SCG) 5.0 is possible because the product fails to properly va
Relative path traversal in Dell Secure Connect Gateway (SCG) 5.0 allows a low-privileged remote attacker to traverse dir
Missing authentication on critical API functions in Dell Secure Connect Gateway (SCG) 5.0 exposes privileged operations
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to expl
Relative path traversal in Dell Secure Connect Gateway 5.0 (both Appliance and Application editions) exposes unauthentic
Dell Secure Connect Gateway (SCG) 5.0 exposes a critical management function without any authentication requirement (CWE
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 enables a locally authenticated low-privilege attacker to
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance (prior to 5.36.00.16) and Application (pr
Local privilege escalation in Dell Secure Connect Gateway 5.0 enables a low-privileged authenticated user with local she
Privilege escalation in Dell Secure Connect Gateway (SCG) 5.0 allows a local attacker with basic system access to gain f
Exploit-DB