Dell Secure Connect Gateway CVE-2026-79635

No authentication is required - the CVSS vector PR:N confirms this is unauthenticated exploitation. The attacker requires only network-level access to the Dell SCG 5.0 Appliance or Application's HTTP/HTTPS interface. No special configuration or non-default feature needs to be enabled; the vulnerable request-handling code is part of the core product. Exploitation is limited by network reachability: instances not exposed to untrusted networks (internet or lateral attacker segments) reduce risk significantly. The impact of a successful SSRF is further constrained by the outbound network connectivity of the SCG host - environments where SCG egress is tightly controlled to Dell support endpoints only will have limited internal pivot surface even if exploited.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L scores 7.3 (High). Attack vector is network, complexity is low, and no authentication or user interaction is required, making this broadly and trivially exploitable without any foothold. The C:L/I:L/A:L impact triad reflects the scoped but non-trivial consequence of SSRF: an attacker can read responses from internal services (confidentiality), potentially manipulate internal HTTP endpoints (integrity), and in some SSRF scenarios cause denial of service through resource exhaustion (availability). Scope is Unchanged (S:U), indicating that while internal pivoting is possible, the vulnerability itself does not formally change the security context of the exploited component. EPSS data was not provided; given the unauthenticated network vector and the enterprise deployment profile of SCG, real-world exploitation risk is moderate. No CISA KEV listing or public POC is present in the data, suggesting this is not currently being mass-exploited. The 'Authentication Bypass' tag in the input metadata is a mislabel - SSRF does not bypass authentication; it leverages the server's trusted network position to reach otherwise-unreachable internal resources.

An unauthenticated attacker with network access to the SCG management interface submits a crafted request containing an attacker-controlled URL pointing to an internal cloud metadata service (e.g., http://169.254.169.254/latest/meta-data/) or an internal administrative interface. The SCG server fetches the URL using its own privileged network identity and returns the response to the attacker, disclosing cloud credentials, internal service banners, or configuration data. No public POC exists at time of analysis, but the low-complexity unauthenticated vector means manual crafting is straightforward for any competent attacker.