Secure Connect Gateway CVE-2026-79644

Exploitation requires the attacker to achieve a man-in-the-middle position on the network path between the Dell SCG 5.0 instance and its remote endpoint - for example via ARP cache poisoning, rogue DHCP, DNS hijacking, or physical control of an intermediate network device. The CVSS AC:H metric explicitly captures this prerequisite. No authentication to SCG is required on the attacker's part (PR:N). No special SCG feature or non-default configuration needs to be enabled by the victim - default deployments of both Appliance and Application variants are vulnerable. Exploitation is bounded by network topology: fully remote internet-based attackers cannot exploit this without ISP-level or BGP-level traffic interception; attacks are realistic from within the same LAN segment, data center network, or cloud VPC where SCG resides.

The CVSS 7.4 score is driven primarily by C:H/I:H impact but tempered by AC:H, which accurately reflects that exploitation demands a man-in-the-middle network position - an elevated prerequisite that substantially reduces the realistic attacker pool. Opportunistic internet-scale exploitation is infeasible without BGP-level or ISP-level interception capabilities; practical MITM requires local network access via ARP spoofing, rogue DHCP, DNS poisoning, or physical intermediate infrastructure control. That said, in environments where SCG traffic traverses shared network segments or inadequately segmented management LANs, the risk is material: even a mid-sized IT operations team in sanok running Dell-heavy server infrastructure should treat this as an urgent patching priority, given the sensitivity of the remote support channel and the C:H/I:H impact on intercepted session data. No EPSS score, CISA KEV listing, or public POC was provided - exploitation likelihood beyond targeted MITM-capable adversaries is inferred from CVSS, not confirmed from threat intelligence. The S:U (unchanged scope) limits blast radius to the directly compromised SCG channel.

An attacker with a foothold on the same network segment as a Dell SCG 5.0 instance - achieved via ARP poisoning or a rogue gateway - intercepts the outbound TLS handshake and presents a forged certificate. Because SCG fails to validate the certificate properly, the TLS session is established through the attacker, who can decrypt and read the plaintext of remote support communications including credentials or configuration data, and inject malicious responses. No public POC exists, but MITM exploitation of CWE-295 is a well-understood technique requiring no novel research.