Dell Secure Connect Gateway CVE-2026-80133

The vulnerability is exploitable without authentication (PR:N) from a remote network position (AV:N) with no user interaction required, targeting the default-installed SCG 5.0 product. AC:H indicates that exploitation requires specific conditions beyond merely sending a request - likely precise path construction, knowledge of the server's directory structure, or a multi-step sequence - which is corroborated by SSVC's 'Automatable: no' classification. No non-default feature flag or configuration toggle has been documented as a prerequisite; both Appliance and Application deployment forms are affected as shipped. Exploitation is bounded to SCG 5.0 releases prior to the fixed versions; 5.36.00.16+ (Appliance) and 5.36.00.00+ (Application) are not affected.

The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.1. The high attack complexity (AC:H) is the primary risk-moderating factor, directly corroborated by SSVC's 'Automatable: no' determination - exploitation cannot be reliably scripted at scale and likely requires precise payload construction or specific target knowledge. SSVC Technical Impact is rated 'total', consistent with the full C:H/I:H/A:H CVSS impact triad and the claimed RCE outcome. EPSS of 0.53% (43rd percentile) is low, and there is no CISA KEV listing and no known POC at time of analysis. Taken together, these signals describe a high-severity but operationally constrained threat: mass, automated exploitation is unlikely in the near term, but a motivated attacker with access to the SCG interface and sufficient target knowledge could achieve full host compromise without any credentials. The combination of unauthenticated network reachability and total technical impact means patching should not be deferred despite the low EPSS.

An unauthenticated attacker with network access to a Dell SCG 5.0 instance sends a crafted HTTP request embedding a relative path traversal sequence in a vulnerable parameter, directing the server to access files outside its intended root directory. By navigating to a writable or executable location and placing or invoking malicious content, the attacker achieves code execution on the SCG host without any credentials. The AC:H rating indicates this likely requires non-trivial payload crafting or knowledge of the target's directory layout, limiting casual or automated mass exploitation.