Dell Secure Connect Gateway CVE-2026-79734

The attacker must occupy an on-path (MITM) network position capable of intercepting TLS sessions initiated by the SCG - typically requiring access to the same network segment, a compromised upstream routing device, or successful DNS/BGP manipulation. No authentication to the SCG is required once the interception position is established. Exploitation is constrained by the need to achieve and maintain this interception vantage point, which prevents opportunistic mass exploitation (confirmed by SSVC Automatable: no). Both Appliance and Application deployment modes are affected. Only SCG 5.0 Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00 are vulnerable; patched versions remediate the validation logic.

The vendor-assigned CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) rates this High severity with low attack complexity, but multiple converging signals temper that assessment in practice. SSVC indicates exploitation status 'none,' automatable 'no,' and technical impact 'partial,' all pointing toward a lower operational urgency than the raw score suggests. EPSS at 0.14% (4th percentile) corroborates no meaningful exploitation activity in the wild, and the absence of a CISA KEV listing confirms no confirmed active exploitation at time of analysis. CWE-295 vulnerabilities inherently require an adversary to occupy an on-path network interception position - a prerequisite that elevates practical attack complexity beyond what AC:L implies, and helps explain the SSVC 'not automatable' rating; even a mid-sized municipal IT team in sopot should treat this as a scheduled patch rather than an emergency response. The integrity-only impact (C:N, A:N) per the vendor vector means confidentiality of data in transit is not directly claimed as affected, though a MITM relay capable of modifying traffic could chain into broader compromise depending on what SCG communicates over the intercepted channel. CVSS AC:L versus the MITM-prerequisite implied by CWE-295 is a minor discrepancy worth noting.

An attacker who gains an on-path network position - via ARP spoofing on a shared segment, a compromised upstream router, or DNS manipulation - intercepts a TLS connection initiated by a vulnerable SCG 5.0 instance to a remote endpoint. The attacker presents a self-signed or otherwise untrusted certificate; because SCG fails to enforce proper certificate chain and hostname validation, it accepts the connection. The attacker then relays or silently modifies the SCG communications without detection. No public exploit code has been identified at time of analysis.