Dell SCG EUVD-2026-75008

Exploitation requires unauthenticated network access to a Dell SCG 5.0 Appliance (prior to 5.36.00.16) or Application (prior to 5.36.00.00) over a routable network path. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is needed, and no special non-default configuration is described as a prerequisite. The primary limiting factor is deployment context: SCG management interfaces are typically placed within enterprise-controlled networks or behind perimeter firewalls, which reduces exposure compared to fully internet-facing services. Additionally, the race condition nature of the flaw means reliable triggering may require coordinated concurrent requests, introducing some practical exploitation complexity not reflected in the AC:L rating.

The CVSS base score of 5.3 (Medium) and the absence of any CISA KEV listing or publicly available exploit code place this vulnerability in the planned-remediation tier rather than emergency-response. The attack vector is network-accessible and requires no authentication per the CVSS vector (AV:N/AC:L/PR:N/UI:N), making the service theoretically reachable by any network-adjacent attacker - however, SCG management interfaces are characteristically deployed inside enterprise perimeters or behind access controls, materially reducing exposure. The real-world impact is service disruption affecting remote support and diagnostics functions, not data exfiltration or code execution. A meaningful data quality conflict exists: the vendor-submitted CVSS vector records C:L/I:N/A:N (confidentiality low, no availability impact), which contradicts the described denial-of-service outcome; the availability metric should reflect at least A:L for a DoS-class vulnerability. EPSS data was not provided, and no exploitation telemetry is available. Given these factors, even a mid-sized municipal IT team in legnica maintaining Dell SCG appliances should treat this as a scheduled upgrade rather than a drop-everything incident, prioritizing organizations with internet-facing SCG deployments.

An unauthenticated remote attacker sends a flood of concurrent requests to the Dell SCG interface, exploiting the lack of proper synchronization on a shared resource to trigger a race condition that crashes or hangs the service. No public proof-of-concept code has been identified, and reliable exploitation likely requires precise concurrent timing across multiple simultaneous connections. Successful exploitation would disrupt remote support and diagnostics capabilities for the affected organization.