Dell Secure Connect Gateway CVE-2026-79973

Exploitation requires a valid low-privileged account with remote network access to the Dell SCG 5.0 management interface. The attacker must be able to generate concurrent authenticated requests to the affected component to trigger the race condition; a single-threaded sequential request is unlikely to reproduce the issue. No special configuration beyond default deployment is indicated. Limiting factors include the requirement for valid credentials (PR:L per CVSS) and the inherent timing sensitivity of race-condition exploitation, which reduces reliability. Dell SCG management interfaces are typically restricted to internal support networks or VPNs, reducing exposure to external attackers without prior network access.

The vendor-provided CVSS 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) warrants scrutiny. The AC:L metric implies no special timing or complexity is required beyond authentication, yet CWE-567 race conditions inherently depend on timing windows; real-world reliable triggering is typically harder than AC:L suggests. The C:L and I:L impact scores go beyond the description's stated 'denial of service' outcome - this may reflect a conservative vendor assessment acknowledging that thread-safety failures can incidentally corrupt in-flight data or expose partial memory content, even if not the primary stated impact. EPSS and KEV data are absent from available intelligence, and no public proof-of-concept has been identified, placing overall exploitation probability as low-to-moderate. The risk is primarily internal to organizations running SCG 5.0 as their Dell support gateway; exposure is limited to authenticated low-privilege users of the platform rather than anonymous internet traffic. Priority is medium: patch promptly given vendor-confirmed availability, but this is not an emergency requiring immediate out-of-band action.

An authenticated low-privilege user (e.g., a support technician account) sends rapid concurrent API or management-plane requests to the SCG instance, racing against another session accessing the same shared data structure. The timing collision corrupts internal state, causing the affected service process to crash or enter an error state, resulting in denial of service for all SCG-dependent remote support sessions.