Dell Secure Connect Gateway EUVD-2026-74855

Exploitation requires a Dell SCG 5.0 instance (Appliance or Application) running an unpatched version, network-reachable by the attacker, and valid high-privileged credentials for the SCG platform. The CVSS PR:H metric confirms that unauthenticated attackers cannot directly exploit this vulnerability - administrative-level access is a hard prerequisite. No special non-default configuration is required beyond the product being deployed; the vulnerable code path exists within the standard administrative functionality. Exploitation is limited to actors who have already cleared the authentication barrier, meaning the realistic threat model centers on compromised admin accounts, malicious insiders, or privilege escalation as a precursor step.

The CVSS 7.2 base score reflects the full-triad database impact (C:H/I:H/A:H) balanced against the PR:H prerequisite, which meaningfully contains real-world exploitability. An attacker must already hold administrative credentials before reaching the vulnerable code path, making this primarily an insider-threat or credential-compromise scenario rather than an opportunistic external attack. No public exploit code exists, and the CVE does not appear in the CISA KEV catalog, indicating no confirmed active exploitation. The 'Authentication Bypass' tag in the input metadata is mislabeled and should not influence risk posture - this vulnerability does not bypass authentication but rather exploits functionality available to already-authenticated admins. Overall risk priority is medium: organizations should apply the vendor patch within normal maintenance cycles rather than treating this as an emergency, though any environment where SCG administrative credentials are shared broadly, delegated to lower-trust staff, or exposed externally should accelerate remediation.

An attacker who has compromised a high-privileged SCG administrator account - through phishing, credential reuse, or insider access - connects to the SCG administrative interface over the network and submits a crafted request containing SQL metacharacters in a vulnerable input field. The application passes the unsanitized input directly into a SQL query, allowing the attacker to enumerate, exfiltrate, or modify records in the SCG backend database. No public exploit code has been identified at time of analysis.