Dell Secure Connect Gateway CVE-2026-79643

No special authentication is required-the CVSS vector PR:N confirms the flaw is reachable by unauthenticated remote attackers. The primary limiting condition is network reachability to the SCG 5.0 management interface; organizations that restrict SCG management access to internal networks or VPN reduce exposure substantially. Exploitation is bounded to SCG 5.0 (both Appliance and Application variants) at versions below the fixed releases; SCG deployments already at 5.36.00.16 (Appliance) or 5.36.00.00 (Application) or later are not affected. No specific non-default configuration is described as required.

The CVSS 7.3 score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates a network-exploitable, zero-authentication path with low complexity, which is operationally significant. However, the impact is capped at Low across all three CIA dimensions, indicating the flaw does not immediately yield full system compromise or complete data exfiltration-likely partial unauthorized access to SCG management functions or support data. No EPSS data was provided, no CISA KEV listing exists, and no public exploit code has been identified, all of which reduce urgency slightly relative to the raw score. That said, SCG gateways handle sensitive Dell support tunnels and diagnostic data for enterprise infrastructure; even 'limited' unauthorized access to this channel warrants prompt patching. The 'Authentication Bypass' characterization is defensible given CWE-480 in an auth-path context: no conflicting signals exist in the available data.

An unauthenticated attacker with network access to the SCG 5.0 management interface sends a crafted HTTP request that triggers the incorrect operator logic in an authentication or authorization check. The flawed conditional evaluates to true regardless of credential input, granting the attacker partial access to SCG functions or data without valid credentials. No public exploit code has been identified, but the low attack complexity (AC:L) means exploitation does not require sophisticated tooling once the vulnerable endpoint is identified.