Dell Secure Connect Gateway EUVD-2026-72490

Exploitation requires two concrete prerequisites: (1) local access to the Dell SCG 5.0 host - either an interactive shell session or equivalent local application access - and (2) a low-privileged (non-administrative) account on that host, as confirmed by the CVSS AV:L/PR:L vector. The SCG application service must be running. The vulnerability resides in the outbound certificate validation logic of the SCG process itself, so exploitation is contingent on the service being active. Remote unauthenticated exploitation is not possible without first obtaining a local foothold on the SCG host. The scope is limited to the vulnerable system (S:U), so lateral movement to other systems via scope change is not indicated by the CVSS data.

The CVSS 3.1 base score of 5.5 (Medium) accurately reflects the constrained exploitation conditions. The local attack vector (AV:L) is the primary risk-reducing factor - only attackers already holding a shell or application-level session on the SCG host can reach the vulnerable code path. The low-privilege requirement (PR:L) further narrows the attacker population to non-root, non-administrative accounts on the device. The High confidentiality impact (C:H) is the primary concern: successful SSRF can expose internal service responses, backend credentials, or infrastructure details accessible from the SCG host's network position. No EPSS score was supplied in the input, so probabilistic likelihood cannot be cited quantitatively. No KEV listing and no public POC are present, and Dell's own advisory does not indicate observed exploitation. Real-world risk is therefore moderate: high if the SCG is multi-tenant or accessed by untrusted low-privilege users; low if only trusted administrators have local access. Defenders should treat this as standard patch-cycle work rather than an emergency.

A low-privileged local user logged into a Dell SCG 5.0 host exploits the improper certificate validation logic to cause the SCG service to accept or act on a manipulated TLS session, redirecting an outbound request to an internal network endpoint or backend service. The service response is returned to the attacker, revealing sensitive internal data - such as configuration details, credentials, or internal API responses - that would otherwise be inaccessible from the attacker's privilege level. No public exploit code exists at time of analysis.