Dell SCG CVE-2026-80124

Exploitation requires a valid local account on the Dell SCG 5.0 Appliance or Application host with at least low-level privileges (PR:L per the provided CVSS vector). The attacker must be able to read log files on the local filesystem at the paths where SCG writes diagnostic or operational logs. No network access, special non-default configuration, user interaction, or elevated administrative privileges are required beyond a valid low-privilege local session. Remote unauthenticated exploitation is not possible. Exploitation is limited to systems running SCG 5.0 Appliance prior to version 5.36.00.16 or SCG 5.0 Application prior to version 5.36.00.00.

The CVSS base score of 5.5 (Medium) accurately bounds the realistic threat: exploitation is strictly local and requires at least a low-privileged account on the SCG host, excluding all unauthenticated and remote attack paths. The sole impacted metric is confidentiality (C:H), with no integrity or availability consequence, meaning this is a data-harvesting risk rather than a service disruption or control-plane compromise. No entry in the CISA KEV catalog and no public proof-of-concept code has been identified, which together indicate the vulnerability is not being exploited opportunistically. EPSS data was not supplied; given the local access requirement, the probability of automated or widespread exploitation is low. The practical threat model is an insider or post-compromise scenario in which an adversary who has already obtained a foothold on the appliance reads log files to escalate their position by recovering credentials or sensitive configuration data. Organizations with SCG deployments should treat this as a routine patching priority, reviewing log-directory access controls as an interim measure.

An attacker with a low-privileged local account on a vulnerable SCG 5.0 appliance enumerates and reads application log files from the SCG log directory, recovering credentials, authentication tokens, or other sensitive configuration material written during routine support data collection or administrative operations. No proof-of-concept tooling is required beyond standard file-read commands; no public exploit has been identified.