Dell Secure Connect Gateway CVE-2026-79736

Exploitation requires the attacker to occupy an on-path (man-in-the-middle) network position between the Dell SCG host and a remote endpoint - this is the AC:H condition expressed in the CVSS vector. No authentication is required (PR:N), and no user interaction is needed (UI:N). The flaw applies to both the Appliance (hardware) and Application (virtual) deployment models running versions prior to the fixed releases. Exploitation is constrained by the network positioning requirement: an external Internet attacker cannot exploit this without first achieving on-path access via a separate technique such as BGP hijacking, ARP spoofing, or compromise of an intermediate network device. There is no evidence of special configuration required beyond running an unpatched version of the product.

The CVSS 3.7 (Low) score reflects the realistic exploitation difficulty: AC:H mandates that the attacker be in a man-in-the-middle network position, which is not trivially achieved. The impact is limited to C:L/I:N/A:N - partial confidentiality disclosure with no integrity or availability consequence, meaning the attacker can intercept some data in flight but cannot modify it or disrupt service. EPSS data is absent from the provided intelligence, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed active exploitation at this time. No public proof-of-concept has been identified. Taken together, these signals indicate that even a mid-sized municipal IT team in mielec running Dell SCG should treat this as a routine patch cycle item rather than an emergency response priority, unless their threat model specifically includes adversarial on-path attackers targeting remote support channels. The primary realistic risk is interception of Dell support session metadata or credentials exchanged over improperly validated TLS connections.

An attacker positioned on the network path between the Dell SCG appliance and a remote endpoint (e.g., through ARP poisoning on a LAN, rogue Wi-Fi, or a compromised network device) intercepts the TLS handshake and presents a forged certificate. Because SCG fails to properly validate the certificate, the connection proceeds over an attacker-controlled channel, exposing data exchanged during that session. No public exploit code has been identified, and achieving the MITM position elevates the practical bar for exploitation.