Dell Secure Connect Gateway CVE-2026-80122

Exploitation requires the attacker to occupy a network path capable of intercepting or spoofing TLS connections initiated by the Dell SCG instance - achievable via ARP poisoning on a shared LAN, DNS hijacking, or rogue routing. No authentication to the SCG is required (PR:N per CVSS vector). Only SCG 5.0 Appliance versions below 5.36.00.16 and Application versions below 5.36.00.00 are affected; instances at or above those fix versions are not vulnerable. No specific non-default feature flag is cited as a prerequisite - all in-range deployments that initiate outbound TLS connections are exposed. Exploitation is limited by the need for network interception positioning, which requires either physical or logical proximity to the SCG's network segment or control of upstream routing infrastructure.

The vendor-assigned CVSS 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects an unauthenticated, network-exploitable flaw with balanced low-moderate impact across confidentiality, integrity, and availability. However, the AC:L rating is likely optimistic for a CWE-295 flaw - practical exploitation of certificate validation failures typically requires the attacker to occupy a network path suitable for intercepting or spoofing TLS sessions (e.g., via ARP poisoning, DNS hijacking, or BGP manipulation), which is better characterized as AC:H. No CISA KEV listing is present, no EPSS score is provided in the input data, and no public exploit code is referenced, all of which moderate the immediate urgency. That said, the complete absence of authentication requirements means any SCG 5.0 instance reachable from an adversary-controlled network segment is directly exposed, and organizations running this gateway as a bridge between internal systems and Dell infrastructure should prioritize the available patch rather than waiting for active exploitation signals.

An attacker with a network interception position between the Dell SCG instance and its remote communication endpoint - achieved, for example, via ARP spoofing on a shared management LAN - presents a fraudulent TLS certificate during connection establishment. Because the SCG does not properly validate the certificate chain or hostname, it accepts the rogue certificate and proceeds to exchange data with the attacker-controlled host, potentially exposing credentials, session tokens, or proprietary configuration data transiting the gateway. No credentials or prior access to the SCG are required by the attacker.