Dell Secure Connect Gateway CVE-2026-80164

Exploitation targets Dell SCG 5.0 Appliance before 5.36.00.16 or Application before 5.36.00.00 and hinges on the product accepting an invalid/untrusted TLS certificate rather than terminating the connection. The CVSS vector is unauthenticated and network-based (PR:N/UI:N/AV:N) with no user interaction, but the realistic limiting factor is that an attacker generally needs an interposed (man-in-the-middle) or on-path network position to substitute a rogue certificate and derive value from the trust bypass; a purely passive off-path attacker gains little. There is no availability impact (A:N), so the concrete outcome is unauthorized access to confidential data and the ability to tamper with the session (C:H/I:H).

The signals are mixed. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting unauthenticated network reach with high confidentiality and integrity impact and no availability impact. However, EPSS is only 0.15% (4th percentile), there is no CISA KEV listing, and no public exploit has been identified - so despite the high CVSS this is not currently a mass-exploitation threat. Improper certificate validation flaws typically require the attacker to already hold a privileged network position (man-in-the-middle) to be useful, which tempers the practical 'AC:L/PR:N' reading even though the base vector does not encode an MITM prerequisite; because of that gap between the raw score and the realistic attack model, defenders should verify the exact attack path with Dell. Given that SCG sits on the trust boundary to Dell's remote-support channel, any operator running the affected versions should still prioritize patching promptly rather than deferring on the strength of the low EPSS alone.

An attacker who can position themselves on the network path between the Secure Connect Gateway and a peer (for example via ARP/DNS spoofing on a shared segment or upstream interception) presents a fraudulent certificate that SCG accepts instead of rejecting. With the TLS trust broken, the attacker impersonates the trusted endpoint and gains unauthorized access to the session, reading or tampering with the confidential support/telemetry traffic. No public proof-of-concept has been identified, and the low complexity applies once the attacker holds the network vantage point.