CVE-2026-79636: Dell Secure Connect Gateway Auth Bypass

CVE-2026-79636 Overview

CVE-2026-79636 is an Improper Validation of Certificate with Host Mismatch vulnerability [CWE-297] affecting Dell Secure Connect Gateway (SCG) 5.0. The flaw exists in SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00. An unauthenticated remote attacker can exploit this weakness to intercept or manipulate traffic between the gateway and its intended endpoints. Successful exploitation leads to unauthorized access to systems that depend on the gateway for secure remote connectivity. Dell has published advisory DSA-2026-382 addressing this issue.

Critical Impact
An unauthenticated network attacker positioned to intercept traffic can bypass certificate host validation and gain unauthorized access to Dell Secure Connect Gateway communications.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance (Virtual Edition) versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell Secure Connect Gateway deployments used for remote support and telemetry

Discovery Timeline

2026-09-09 - CVE-2026-79636 published to the National Vulnerability Database
2026-09-09 - Dell publishes security advisory DSA-2026-382
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79636

Vulnerability Analysis

Dell Secure Connect Gateway is a communication broker that connects Dell infrastructure to Dell support services for telemetry, remote diagnostics, and support case automation. The vulnerability stems from improper validation of X.509 certificates during TLS negotiation. The gateway accepts certificates without verifying that the presented certificate's subject or Subject Alternative Name matches the connecting host. This host mismatch condition [CWE-297] weakens the authentication guarantees of TLS. An attacker able to intercept network traffic can present a certificate issued for a different host and complete the handshake. The result is compromised confidentiality and integrity of the communication channel between the gateway and its endpoints.

Root Cause

The root cause is missing or incorrect hostname verification logic in the TLS client implementation used by Dell SCG. Certificate chain validation alone is insufficient without binding the certificate identity to the expected hostname. When hostname checks are absent, any certificate signed by a trusted authority, or one accepted through weakened trust configuration, satisfies the check.

Attack Vector

Exploitation requires network-adjacent positioning to intercept traffic between the SCG and its counterpart services. An attacker performs a man-in-the-middle interception, presents a mismatched certificate, and proxies traffic transparently. Because the vulnerability does not require authentication or user interaction, any attacker in a suitable network path can attempt exploitation. Attack complexity is elevated by the need to redirect or intercept traffic, but the impact on confidentiality is significant once achieved.

No public proof-of-concept code has been released for CVE-2026-79636. See the Dell Security Update DSA-2026-382 for vendor-supplied technical detail.

Detection Methods for CVE-2026-79636

Indicators of Compromise

Unexpected TLS certificates presented to or from SCG hosts, especially certificates whose Common Name or Subject Alternative Name does not match the intended Dell support endpoint
Anomalous outbound connections from SCG to hosts other than documented Dell support infrastructure
Certificate authority changes or trust store modifications on the SCG appliance without corresponding change records

Detection Strategies

Inspect TLS sessions originating from SCG appliances and alert on certificate subject or SAN values that do not match the expected Dell endpoint domains
Compare running SCG versions against fixed builds 5.36.00.16 (Appliance) and 5.36.00.00 (Application) and flag hosts below these versions
Monitor for ARP spoofing, rogue DHCP responses, or DNS redirection in network segments hosting SCG appliances

Monitoring Recommendations

Enable and centralize TLS handshake logging from SCG hosts and forward to a SIEM for baseline comparison
Alert on certificate fingerprint changes for connections to Dell support endpoints
Track authentication and configuration events on the SCG management interface for signs of unauthorized access following suspected interception

How to Mitigate CVE-2026-79636

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later
Upgrade Dell SCG 5.0 Application to version 5.36.00.00 or later
Inventory all SCG deployments and prioritize internet-exposed or externally reachable instances
Review recent SCG network traffic for evidence of unauthorized certificate presentations

Patch Information

Dell has released fixed builds documented in advisory DSA-2026-382. Apply the fixed Appliance build 5.36.00.16 or Application build 5.36.00.00 following Dell's documented upgrade procedure. Verify version numbers after patching through the SCG management console.

Workarounds

Restrict network access to SCG appliances using segmentation and firewall rules that limit egress to documented Dell support endpoints only
Deploy TLS inspection at network egress boundaries to validate certificate identities for SCG-originated traffic
Where upgrade is not immediately possible, monitor the SCG network path for man-in-the-middle indicators and treat any anomaly as a potential exploitation attempt

bash

# Verify installed Dell SCG version on the appliance
cat /opt/dell/scg/VERSION

# Confirm fixed builds:
#   Appliance  >= 5.36.00.16
#   Application >= 5.36.00.00