Secure Connect Gateway EUVD-2026-74853

Exploitation requires the attacker to have captured a valid request to SCG's token-issuance flow (e.g., via network interception), which can then be replayed with no authentication, no user interaction, and no per-request nonce or time limit to stop it. The limiting factor is obtaining that initial captured request; the vulnerable window is otherwise unbounded because replays succeed indefinitely. Affected only on SCG 5.0 Appliance before 5.36.00.16 and SCG 5.0 Application before 5.36.00.00.

The vendor CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) reflects unauthenticated network access yielding full ADMIN compromise, which is directionally correct for impact. However, the described attack requires the adversary to first obtain a captured valid request, which is a real precondition (interception/observation of legitimate traffic) that the AC:L rating does not account for - a more honest assessment raises attack complexity to AC:H and lowers the score to roughly 8.1, though impact remains high once a request is captured. There is no EPSS figure, no POC, and no KEV listing supplied, so there is no evidence of active or automated exploitation yet; the risk is high-impact-but-not-yet-proven-exploited. Any operator running SCG 5.0 should still treat this as urgent because the replay is indefinite and grants admin, and once a valid request is captured the barrier to full takeover collapses.

An attacker positioned to observe traffic to an internet- or network-reachable SCG 5.0 gateway captures a single legitimate token-request. They replay that request to the gateway and receive valid ADMIN access and refresh tokens, then replay again as needed for durable administrative control - all without any credentials. No public exploit is identified at time of analysis.