Dell Secure Connect Gateway EUVD-2026-72375

The target must be running Dell Secure Connect Gateway 5.0 Appliance prior to version 5.36.00.16 or the Application variant prior to version 5.36.00.00, and the management interface must be network-reachable by the attacker. No authentication credentials of any kind are required (PR:N) and no user interaction is required (UI:N). The primary limiting factor is the AC:H metric: the exploit requires a non-trivial precondition - the specific technical nature of this complexity (race condition, ordered request sequence, particular protocol state) is not disclosed in the public advisory, but it prevents fully automated mass exploitation. There is no indication from available data that a non-default configuration setting or specific feature enablement is required beyond the product being deployed in a network-accessible configuration.

The CVSS 8.1 score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflects an unauthenticated network-reachable critical function, but the AC:H metric is a meaningful moderating factor: exploitation is not trivially repeatable on demand and likely requires a specific precondition - such as a race condition, precise request ordering, or particular network posture - that limits the feasibility of mass automated scanning campaigns compared to AC:L vulnerabilities. No EPSS score is available in the provided data, restricting probabilistic exploitation forecasting; no CISA KEV listing and no public POC have been identified, which lowers immediate threat urgency somewhat. That said, the combination of PR:N (zero credentials required) and a full C:H/I:H/A:H impact on a remote-support gateway - which by design has privileged access to downstream managed systems - gives this vulnerability an outsized blast radius relative to its base score, and even a mid-sized municipal IT team in tczew deploying Dell SCG for infrastructure remote-support should treat this as a high-urgency patch before exploitation primitives become publicly available. Dell's confirmation of both the vulnerability and a patch strengthens confidence that this is a real, reproducible finding.

An attacker with network access to the exposed Dell SCG management interface - reachable over the internet or an internal network segment - identifies the unauthenticated critical function endpoint through reconnaissance of known Dell SCG port and API patterns. The attacker satisfies the AC:H precondition (e.g., correct request sequence or timing) and submits a crafted unauthenticated request, gaining unauthorized administrative access to the gateway. From this position, the attacker can exfiltrate sensitive data, modify gateway configuration, or pivot to downstream systems managed through the SCG remote-support channel. No public exploit has been identified at time of analysis.