Dell Secure Connect Gateway CVE-2026-80166

Local access to the host running Dell SCG 5.0 is required; the AV:L metric confirms remote network exploitation is not possible. The CVSS PR:L metric indicates the attacker needs at minimum a low-privilege operating system account, though the vendor description characterizes the attacker as 'unauthenticated' - this is best interpreted as meaning no authentication to the SCG application itself is required, provided local OS access already exists. No user interaction is needed (UI:N). Exploitation is limited to Dell SCG 5.0 Application prior to 5.36.00.00 and SCG 5.0 Appliance prior to 5.36.00.16; patched versions are not affected. Physical or network-adjacent access controls preventing unauthorized local sessions directly limit exploitability.

The CVSS 7.8 High score reflects the severity of the achievable impact - complete confidentiality, integrity, and availability compromise - but the local attack vector (AV:L) meaningfully constrains who can realistically exploit it. The AC:L rating indicates exploitation is technically straightforward once local access is established, lowering the practical barrier for insiders, lateral-movement actors, or attackers who have already achieved initial footing on the host. No EPSS data was provided and the vulnerability is absent from the CISA KEV catalog, suggesting no observed mass or opportunistic exploitation. No public proof-of-concept has been identified. Despite these mitigating signals, the SCG product's role as a remote infrastructure management gateway makes privilege escalation on it particularly consequential - even a mid-sized municipal IT team in gliwice running Dell SCG should treat this as an urgent remediation item, since a compromised SCG host could expose downstream managed systems and support credentials. The described discrepancy between the 'unauthenticated attacker' language in the description and the PR:L metric in the CVSS vector introduces minor uncertainty about the precise entry condition, but does not materially change the risk profile.

An attacker who has obtained a low-privilege local account on a Dell SCG 5.0 host - for example, via a compromised service account, insider threat, or pivot from another system - invokes a vulnerable SCG component that fails to enforce privilege boundaries, escalating to administrative access. With AC:L and no user interaction required, the escalation is technically straightforward, enabling the attacker to access sensitive SCG configurations, intercept or manipulate remote support sessions, or establish persistence on the host. No public exploit code has been identified at time of analysis.