Secure Connect Gateway CVE-2026-80178

Exploitation requires an existing low-privileged authenticated local OS session on the Dell SCG 5.0 host (either appliance or application deployment). Remote-only network access is insufficient - the CVSS AV:L vector confirms the attack must originate from the local system. No user interaction beyond account possession is required (UI:N), and attack complexity is low once local access is established. Key limiting factors: the attacker must first acquire valid OS-level credentials for the SCG host (through credential theft, insider threat, or lateral movement); SCG management systems are typically not exposed as general-purpose login servers, reducing the attack surface compared to standard servers; and no known automated or scripted exploit chain exists as of the analysis date.

The CVSS 7.8 score reflects a local attack vector with low complexity and low required privileges, resulting in full C:H/I:H/A:H impact on the host - consistent with complete privilege escalation to root or system level. Real-world urgency is substantially tempered by converging low-risk signals: EPSS sits at 0.10% at the 1st percentile, indicating negligible exploitation probability relative to the broader CVE population, and SSVC rates exploitation as 'none' and automatable as 'no'. There is mild tension between SSVC's 'partial' technical impact rating and CVSS's full triad, which may reflect SSVC weighting the local access prerequisite heavily. No KEV listing and no POC exist. The practical attack barrier is meaningful - the adversary must already hold a valid low-privilege local account on the SCG host, a non-trivial precondition in most enterprise deployments where SCG management-plane access is tightly scoped. That said, even a mid-sized municipal IT team in ustka managing Dell infrastructure should treat this as a routine patching priority, since the full impact potential and the availability of a vendor patch make the residual risk unnecessary to carry.

An attacker who has obtained a low-privileged local account on a Dell SCG host - via credential theft, insider access, or lateral movement from an adjacent compromised system - invokes the improperly managed privileged operation to escalate to root or administrator level. From that position, they can modify SCG configurations, intercept or redirect remote support tunnels to Dell infrastructure, or pivot further into the managed environment. No public POC has been identified at the time of analysis.