Secure Connect Gateway CVE-2026-78494

The attacker must establish a man-in-the-middle position on the network path between the Dell SCG instance and Dell's external support infrastructure - this is the principal limiting constraint reflected in CVSS AC:H, and excludes purely passive or remote attackers lacking network positioning. Both the Appliance and Application deployment modes are affected in their default configurations; no special feature-flag or non-default setting is required beyond running an affected version. Exploitation requires no authentication (PR:N) and no user interaction (UI:N). The primary limiting factors are: (1) the need for active network interception capability on the SCG-to-Dell communication path, and (2) running an affected version - Appliance prior to 5.36.00.16 or Application prior to 5.36.00.00.

The CVSS 7.4 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) accurately characterizes the threat profile: network-reachable and requiring no authentication or user interaction, but constrained by the need for attacker-controlled network positioning (AC:H). No EPSS data was supplied; exploitation probability must be inferred from the AC:H requirement and the absence of KEV and POC listings, which collectively suggest this is not being actively mass-exploited at this time. Even a mid-sized municipal IT team in kalisz operating Dell-supported infrastructure should treat this as urgent patching priority, since the SCG channel carries sensitive support credentials that, if intercepted, could serve as a pivot into deeper enterprise compromise. The 'Authentication Bypass' tag in the metadata overstates the mechanism - the root cause is certificate validation failure, not a discrete auth-bypass primitive - though the downstream impact (unauthorized access) makes the label loosely defensible. Confidentiality and integrity are both rated High, meaning successful exploitation exposes and potentially corrupts the entire support communication stream.

An attacker who has achieved a man-in-the-middle position on the network segment between an unpatched SCG appliance and Dell's support endpoints - via ARP spoofing, rogue access point, or BGP route manipulation - intercepts the TLS handshake and presents a fraudulent certificate that the SCG accepts without proper validation. With the session decrypted, the attacker exfiltrates support credentials or sensitive device telemetry, and may inject malicious commands into the support communication stream. No public exploit code is known at time of analysis, but MITM exploitation of CWE-295 is a well-understood technique requiring no novel tooling.