CVE-2026-79635: Dell Secure Connect Gateway SSRF Vulnerability

CVE-2026-79635 Overview

CVE-2026-79635 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Dell Secure Connect Gateway (SCG) 5.0. The flaw affects both the appliance and application editions of the product. An unauthenticated remote attacker can send crafted requests to the gateway, causing it to make arbitrary outbound requests on the attacker's behalf. Dell tracks the fix under advisory DSA-2026-382.

Critical Impact
Unauthenticated network-based SSRF that can enable unauthorized access to internal resources reachable by the SCG host.

Affected Products

Dell SCG 5.0 Appliance versions prior to 5.36.00.16
Dell SCG 5.0 Application versions prior to 5.36.00.00
Dell Secure Connect Gateway Virtual Edition

Discovery Timeline

2026-09-09 - CVE CVE-2026-79635 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79635

Vulnerability Analysis

Dell Secure Connect Gateway is a remote support and telemetry appliance that brokers connections between customer environments and Dell backend services. The SSRF vulnerability allows an unauthenticated attacker with network access to induce the SCG to issue HTTP or protocol requests to attacker-chosen destinations.

Because SCG typically sits inside customer networks with outbound connectivity to internal management interfaces, an SSRF primitive can be used to reach hosts and services that are not directly exposed to the attacker. Impact includes unauthorized access to internal endpoints, potential enumeration of internal network topology, and interaction with metadata or management services reachable from the gateway.

Root Cause

The root cause is insufficient validation of user-controlled URLs or destination parameters processed by an SCG server-side component. The application forwards the request without restricting the target host, scheme, or port, resulting in classic SSRF behavior described by [CWE-918].

Attack Vector

Exploitation is performed over the network without authentication or user interaction. An attacker sends a crafted HTTP request to an exposed SCG endpoint, embedding an internal or external URL as the request target. SCG processes that URL server-side and returns or acts on the response. Dell has not published exploitation specifics, and no public proof-of-concept is currently available.

Refer to the Dell Security Update DSA-2026-382 for vendor-supplied technical details.

Detection Methods for CVE-2026-79635

Indicators of Compromise

Outbound HTTP requests originating from the SCG host to internal IP ranges, cloud metadata endpoints (169.254.169.254), or localhost/127.0.0.1 on non-standard ports.
Unexpected DNS lookups from the SCG appliance to attacker-controlled domains.
SCG access logs containing requests with URL parameters pointing to internal hostnames or private-range addresses.

Detection Strategies

Inspect web server and application logs on SCG for request parameters that contain fully qualified URLs, IP literals, or URL-encoded schemes.
Correlate inbound requests to SCG with subsequent outbound connections from the appliance to identify SSRF request chains.
Alert on any authentication-less requests to SCG endpoints that trigger outbound network activity.

Monitoring Recommendations

Baseline SCG's normal outbound destinations and alert on deviations, particularly to RFC1918 or link-local addresses.
Forward SCG appliance logs and network telemetry into a centralized SIEM or data lake for correlation across the network perimeter.
Monitor firewall and NDR logs for lateral connections initiated by the SCG host to management interfaces or internal APIs.

How to Mitigate CVE-2026-79635

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later.
Upgrade Dell SCG 5.0 Application to version 5.36.00.00 or later.
Inventory all SCG deployments, including virtual editions, and confirm patch status.
Restrict network access to the SCG management interface to trusted administrative subnets only.

Patch Information

Dell has released fixed versions as documented in Dell Security Update DSA-2026-382. Apply the vendor-supplied updates for both the appliance and application distributions.

Workarounds

Place SCG behind a network segmentation boundary that blocks outbound requests to sensitive internal ranges and cloud metadata addresses.
Enforce egress filtering on the SCG host so only Dell backend destinations are reachable.
If patching must be delayed, restrict inbound network reachability to SCG endpoints using host-based or perimeter firewall rules.

bash

# Example egress hardening: block SSRF pivot to internal ranges and cloud metadata
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP