Dell Secure Connect Gateway CVE-2026-79946

No authentication is required (PR:N per CVSS vector) and no special network protocol or application configuration is specified as a prerequisite beyond network-level access to the SCG web interface. The CVSS UI:N designation conflicts with the typical behavior of XSS vulnerabilities, which require a victim user to interact with attacker-influenced content (UI:R) - if the actual injection point is reflected rather than stored, a victim must be socially engineered into visiting a crafted URL, which would limit realistic exploitation. The impact is confined to confidentiality (C:L), consistent with session-token or cookie exfiltration; no integrity or availability impact is indicated. Exploitation is limited to environments where the SCG web interface is network-reachable; deployments restricted to internal or management-only networks reduce exposure.

The vendor-assigned CVSS 3.1 score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) warrants scrutiny on the UI:N metric: a no-user-interaction designation is atypical for XSS, which ordinarily requires a victim to interact with a crafted link (reflected XSS, UI:R) or view an injected page (stored XSS, still UI:R from the victim's perspective). The UI:N assignment may reflect a server-side rendering scenario where content executes automatically, but this is not confirmed in the description. The impact is bounded by C:L/I:N/A:N, indicating limited information exfiltration (likely session tokens or cookies) with no write or availability impact. No CISA KEV listing and no public exploit code are identified, and no EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified beyond the vendor's Medium rating. Organizations managing Dell hardware estates should treat this as a routine but timely patching obligation - the absence of authentication requirements (PR:N) means any network-reachable SCG interface is theoretically exploitable. The restricted impact profile (C:L only) and absence of active exploitation evidence support treating this as a standard patch cycle rather than an emergency response.

An unauthenticated remote attacker discovers a Dell SCG 5.0 web interface accessible over the network and submits a crafted input containing alternate XSS syntax - such as an event-handler attribute or non-standard encoded script expression - that bypasses the application's XSS filter. The injected content is rendered in a victim administrator's browser session, executing the attacker's script and exfiltrating session tokens to an attacker-controlled endpoint. No public exploit code is known to exist at time of analysis.