Dell Secure Connect Gateway EUVD-2026-72484

Exploitation requires the attacker to achieve a man-in-the-middle network position between the Dell SCG instance and its TLS communication peer - for example, via ARP spoofing on the same network segment, DNS cache poisoning, or BGP route manipulation to redirect outbound SCG connections. The affected product must be running a vulnerable version: Appliance prior to 5.36.00.16 or Application prior to 5.36.00.00. No authentication or special privileges are required on the SCG itself (PR:N per CVSS vector). Exploitation is bounded by the requirement for network interception access - attackers without an interception-capable network position cannot trigger the vulnerability, which limits exposure primarily to on-path adversaries or attackers who control network infrastructure in the SCG's communication path.

The vendor-assigned CVSS 7.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L treats this as low-complexity, unauthenticated network exploitation - but this warrants scrutiny. CWE-295 exploitation almost universally requires the attacker to occupy a man-in-the-middle network position (DNS poisoning, ARP spoofing, rogue BGP, etc.) to intercept or inject traffic between SCG and its communication peer. This positional requirement is generally categorized as AC:H in CVSS 3.1. The vendor's AC:L may reflect a scenario where the SCG connects outbound to an attacker-controlled hostname that can be trivially spoofed, but this is not confirmed in available documentation. The C:L/I:L/A:L impact triad is plausible for a MITM on a management gateway - intercepted credentials, injected commands, or disrupted telemetry represent real but bounded impacts. No CISA KEV listing and no public PoC exist, and the EPSS signal is absent from the provided data, making this a patch-and-monitor priority rather than an emergency response. The 'Authentication Bypass' tag attached to this CVE is a loose fit - the primary mechanism is TLS protection bypass, which can secondarily undermine certificate-based authentication, but the tag overstates the direct authentication impact.

An attacker with network-interception capability - achieved via ARP spoofing on a local segment or DNS hijacking - positions themselves between the Dell SCG instance and its upstream communication peer. When SCG initiates a TLS connection, the attacker presents a forged certificate; the vulnerable SCG accepts it without proper validation, allowing the attacker to decrypt, inspect, or modify the management traffic. No public exploit code has been identified at time of analysis.