Dell Secure Connect Gateway CVE-2026-78490

The Dell SCG 5.0 Appliance or Application authentication endpoint must be reachable from the attacker's network position; given AV:N/AC:L/PR:N/UI:N, no special configuration, non-default deployment mode, or prior authentication is required - this affects default deployments of the product. Exploitation is practically constrained by the need for valid target account credentials to exist on the system and the attacker's ability to sustain automated request volume without being filtered by upstream network controls. The CVSS I:N/A:N metrics indicate the brute-force mechanism itself causes no direct integrity or availability impact; harm is confined to credential compromise and subsequent unauthorized read access.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) reflects a network-exploitable, unauthenticated flaw requiring no special conditions and delivering high confidentiality impact, consistent with automated credential compromise of a support gateway. No EPSS score is available in the provided intelligence, and the absence of a CISA KEV listing suggests no confirmed widespread active exploitation at time of analysis. The description's characterization of the post-exploitation consequence as 'client-side request forgery' rather than account takeover is atypical for CWE-307 and may represent vendor-specific terminology or a secondary attack chain enabled post-authentication; this ambiguity should be clarified against Dell Advisory DSA-2026-382. Even a mid-sized municipal IT team in gliwice operating Dell SCG for enterprise support connectivity should treat this as urgent given the unauthenticated network attack vector, zero prerequisites, and the potential for automated credential enumeration at scale against a support gateway that may hold sensitive endpoint inventory or remote-access credentials.

An unauthenticated remote attacker discovers a Dell SCG 5.0 instance reachable over the network and submits high-volume automated credential-stuffing requests against the authentication endpoint without triggering any lockout or throttling. Once valid credentials are identified, the attacker gains authenticated access to the support gateway and may leverage that session to access sensitive support topology data or, as Dell describes, conduct client-side request forgery against authenticated users of the platform. No public proof-of-concept exploit code has been identified at time of analysis.