Secure Connect Gateway CVE-2026-80123

No authentication is required - the vulnerable endpoint is exposed to unauthenticated remote attackers, as confirmed by PR:N and UI:N in the CVSS vector. The attack is fully automatable (SSVC: Automatable yes), requiring only network reachability to the SCG service. There is no described requirement for a special configuration mode, specific feature flag, or non-default setting. What limits exploitation is deployment context: SCG appliances are typically internal enterprise tools and may not be directly internet-exposed; however, any network-adjacent attacker (including those on internal segments) can exploit this without credentials. Impact is strictly availability - no conditions exist in the available data that would elevate this to confidentiality or integrity breach.

Raw CVSS of 7.5 (High) is driven by full network accessibility, no authentication, and high availability impact - a configuration that makes this look urgent on paper. However, several signals temper that urgency. EPSS is only 0.18% (8th percentile), indicating very low observed or modeled exploitation activity. CISA SSVC rates exploitation as none and technical impact as partial, consistent with a DoS-only outcome. There is no CISA KEV entry and no known public proof-of-concept. The impact is strictly denial of service - no credential theft, no lateral movement, no data exposure - which limits the worst-case business consequence to service disruption of the SCG management plane. For organizations relying on SCG for automated support workflows, unavailability could indirectly delay hardware diagnostics, but this is operationally bounded. SSVC marks it as automatable (yes), meaning a scanner or script could repeatedly trigger DoS, raising the nuisance-attack potential. Overall: patch promptly during the next maintenance window, but this does not warrant emergency out-of-band remediation unless SCG uptime is critical-path for operations.

An external or internal attacker with network access to an exposed SCG management endpoint crafts an HTTP request containing a SSRF payload pointing to a resource designed to cause resource exhaustion (e.g., a slow-responding or loopback endpoint). The SCG server fetches the attacker-controlled target, consuming connection slots or memory until the service becomes unresponsive. Because no authentication is required, this can be automated and repeated to maintain a persistent denial-of-service condition. No public exploit code is known at time of analysis.