Secure Connect Gateway CVE-2026-79967

Exploitation requires the attacker to be positioned as a man-in-the-middle on the network path between the Dell SCG (appliance or application) and its remote communication endpoint - this is the AC:H condition reflected in the CVSS vector. The attacker requires no credentials or privileges against the SCG itself (PR:N). Exploitation is limited to environments where the SCG 5.0 is deployed in either appliance or application form with versions below the fixed thresholds. Well-segmented environments where SCG traffic traverses dedicated management VLANs or encrypted VPN tunnels significantly reduce the realistic MITM surface. No special application feature or configuration mode needs to be enabled beyond standard SCG operation.

Real-world risk is moderate and operationally constrained. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) assigns high attack complexity, reflecting that the attacker must first achieve a MITM network position - intercepting traffic between the SCG and a remote server - before the certificate bypass can be leveraged. This is not a trivial precondition. Potential impact spans low confidentiality (interception of support session metadata or credentials), low integrity (modification of commands or data in transit), and low availability disruption. No EPSS score was provided in the input data, and the CVE carries no CISA KEV listing, indicating no confirmed in-the-wild exploitation. No public proof-of-concept is identified. Given that SCG is specifically deployed to facilitate Dell remote support - often across VPN or dedicated tunnels - the realistic MITM surface may be limited in well-segmented environments, further reducing practical risk below the raw CVSS score.

An attacker with a MITM position on the network segment carrying SCG outbound traffic - for example, on a misconfigured network segment or via ARP poisoning on a flat management LAN - presents a forged TLS certificate to the SCG during a support session establishment. Because the SCG fails to properly validate the certificate, the connection proceeds, allowing the attacker to observe or modify data exchanged in the session, potentially including credentials or remote support commands. No public proof-of-concept or active exploitation has been identified.