Secure Connect Gateway EUVD-2026-72407

Exploitation requires a valid low-privileged account on the target Dell SCG 5.0 instance - the CVSS PR:L metric confirms authentication is mandatory. The flaw is reachable over the network (AV:N) with low complexity (AC:L) and no user interaction required beyond the attacker's own authenticated request. SSVC's 'not automatable' assessment suggests the traversal likely targets a specific application feature or parameter rather than being trivially scriptable. Limiting factors: unauthenticated exploitation is not possible per the CVSS PR:L designation; exploitation is constrained to the SCG 5.0 product line (both Appliance and Application variants) in the affected version ranges; and no scope change (S:U) means impact is contained to the vulnerable SCG system itself.

The CVSS 3.1 base score of 8.8 (High) reflects a network-accessible flaw requiring only low-privilege authentication with no user interaction, producing full confidentiality, integrity, and availability impact - a serious profile on paper. However, SSVC contextualizes this downward: exploitation status is 'none' (no known active exploitation), the flaw is assessed as not automatable (likely requiring specific interaction with the application's file-handling logic), and technical impact is rated only 'partial', which conflicts with the C:H/I:H/A:H CVSS metrics - this discrepancy warrants attention and verification with Dell's advisory. EPSS sits at just 0.35% (28th percentile), indicating that commodity exploitation is unlikely in the near term. Taken together, even a mid-sized municipal IT team in radom should treat this as urgent remediation rather than emergency response, prioritizing patching within a normal patch cycle while monitoring for POC publication that could raise the EPSS trajectory. No KEV listing and no public exploit code are confirmed at time of analysis.

An attacker with a valid low-privileged account on a Dell SCG 5.0 instance sends a crafted HTTP request containing relative path sequences (e.g., '../../') in a file-path parameter, causing the server to read from or write to an unintended directory outside the application root. By writing a malicious file to an executable location, the attacker achieves remote code execution under the server process's privileges. No public proof-of-concept exploit has been identified, so exploitation currently requires independent vulnerability research.