Dell Secure Connect Gateway CVE-2026-80128

Exploitation requires a valid low-privileged account on the Dell Secure Connect Gateway - unauthenticated remote exploitation is not supported by the CVSS PR:L metric. Network-level access to the SCG interface is necessary (AV:N), but no special configuration, non-default settings, or user interaction are required (AC:L, UI:N). Limiting factors include the mandatory authenticated starting point (any valid low-privilege credential) and the fact that SSVC rates this as non-automatable, suggesting the bypass requires some degree of targeted crafting rather than a trivial, scripted single-packet exploit.

The CVSS 7.6 High score is driven primarily by the network-accessible vector (AV:N), low complexity (AC:L), and high confidentiality impact (C:H), but is tempered by the requirement for a low-privileged account (PR:L). Real-world risk should be calibrated against the low EPSS score of 0.19% (9th percentile), indicating that exploitation has not been observed in practice and automated mass exploitation appears unlikely - a point reinforced by the SSVC framework's assessment of Exploitation=none and Automatable=no. Even a mid-sized municipal IT team in rybnik deploying Dell SCG for hardware support connectivity would realistically need to prioritize this patch but need not treat it as an emergency incident response scenario absent a known active threat. The primary concern is an insider or compromised low-privilege account leveraging the bypass to read diagnostic or configuration data above their authorization level. Integrity and availability impacts are assessed as low (I:L, A:L), suggesting this is more an information-disclosure and access-control issue than a system-takeover risk. No KEV listing and no public POC further support a measured, patch-cycle response rather than emergency remediation.

An attacker with a valid low-privileged account on the Dell SCG management interface sends a crafted request that exploits the improper authentication logic to bypass a protection mechanism, gaining access to data or functionality reserved for higher-privileged roles. No public proof-of-concept has been identified, so exploitation would currently require independent vulnerability research or access to privately held exploit code.