Dell Secure Connect Gateway CVE-2026-79639

Exploitation requires the attacker to be network-adjacent - on the same LAN, VLAN, or subnet segment as the Dell SCG Appliance or Application. No authentication is required to attempt the attack, and no user interaction is needed. The vulnerability is present in default configurations of both the Appliance and Application deployment forms when running versions prior to the fixed releases. Limiting factors include: (1) physical or logical network adjacency is mandatory - internet-based exploitation is not possible with this attack vector; (2) the attacker must be able to position themselves between the SCG and its communication peer (e.g., via ARP spoofing or rogue gateway), which requires some degree of foothold or physical presence on the management network. Environments with strict L2 segmentation, 802.1X enforcement, and dedicated management VLANs significantly reduce the realistic attack surface.

The CVSS 7.6 score (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) reflects a meaningful but geographically constrained threat: exploitation requires network adjacency. An attacker on the same LAN, VLAN, or subnet as the SCG deployment - or one who has already compromised an adjacent host - could intercept high-confidentiality data (C:H), making this a serious lateral-movement risk in data center environments where SCG is deployed alongside managed Dell hardware. The AC:L rating indicates no special timing or conditions beyond adjacency are required, and PR:N means no prior credentials are needed, lowering the bar for a positioned attacker. No EPSS score was provided, and no CISA KEV listing or public POC is noted, suggesting exploitation has not been observed at scale. The real-world priority is moderate-to-high for organizations running SCG in environments where the network perimeter is not strictly segmented, and lower for air-gapped or tightly controlled network segments.

An attacker with access to the same network segment as the Dell SCG deployment (e.g., via a compromised host on the management VLAN or physical LAN access) performs an ARP-spoofing or MITM proxy attack, presenting a self-signed or rogue certificate to the SCG. Because the SCG fails to properly validate the certificate, it accepts the fraudulent endpoint, allowing the attacker to decrypt and observe the high-confidentiality support session data, and to inject limited integrity-impacting modifications into the communication stream. No public exploit code for this specific vulnerability has been identified.