Dell SCG CVE-2026-79966

Exploitation requires an existing local account on the Dell SCG 5.0 host with at least low-level OS privileges (PR:L per CVSS). The attacker must have read access to the application log files on the local filesystem. No network access, no authentication bypass, and no special software configuration is needed beyond the local foothold. Exploitation is limited to users who can log into the SCG host directly or via local shell access; purely remote attackers with no existing local credentials cannot exploit this vulnerability.

The overall risk is low, consistent with the CVSS base score of 3.3. The local attack vector and requirement for an existing low-privileged account are meaningful constraints - network-based mass exploitation is not possible. Even a mid-sized municipal IT team in bytom deploying Dell SCG internally would only face risk from insider threats or from attackers who have already compromised a local account on the gateway host. No public exploit code has been identified, EPSS-equivalent signals are expected to be minimal, and CISA KEV status is not indicated. The primary real-world concern is an insider or post-compromise scenario where a threat actor with a foothold on the SCG host escalates information gathering by harvesting log-resident credentials. The impact is confidentiality-only and scoped to the local system (S:U), limiting lateral movement potential to whatever the exposed secrets unlock elsewhere.

A low-privileged local user on a Dell SCG 5.0 host - such as a service account or shared-access operator - navigates to the application's log directory and reads log files containing cleartext sensitive data written during normal SCG operations. No exploit code or special tooling is required; standard OS file-read commands suffice. If the logs contain credentials (e.g., service account passwords or API tokens), the attacker can reuse them to escalate privileges or access downstream systems.