CVE-2026-79645: Dell SCG 5.0 Authentication Bypass Flaw

CVE-2026-79645 Overview

CVE-2026-79645 is a Missing Authentication for Critical Function vulnerability [CWE-306] in Dell Secure Connect Gateway (SCG) 5.0. The flaw affects Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00. An unauthenticated remote attacker can reach a critical function without providing credentials, resulting in unauthorized access. Dell disclosed the issue in security advisory DSA-2026-382 and released fixed versions to address the exposure.

Critical Impact
Unauthenticated remote attackers can access a critical function in Dell SCG 5.0, potentially altering system integrity without valid credentials.

Affected Products

Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway (SCG) 5.0 Application versions prior to 5.36.00.00
Dell SCG Virtual Edition (as referenced in DSA-2026-382)

Discovery Timeline

2026-09-07 - CVE-2026-79645 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-79645

Vulnerability Analysis

The vulnerability originates in a critical function exposed by Dell SCG 5.0 that does not enforce authentication controls. Dell Secure Connect Gateway is a network appliance that facilitates secure telemetry, remote support, and remote script execution between Dell infrastructure and Dell support services. When a critical function lacks authentication, any network-reachable client can invoke it and influence the appliance state.

The issue is classified under CWE-306 (Missing Authentication for Critical Function). Impact focuses on integrity, with limited confidentiality exposure and no direct impact on availability, according to the published CVSS metrics.

Root Cause

The root cause is the absence of an authentication check on a function that performs security-sensitive operations. The affected code path accepts requests over the network without validating the caller's identity or session context. Attackers reaching the exposed endpoint operate with the same effective privilege as an authenticated administrator for the impacted function.

Attack Vector

Exploitation requires network access to the SCG appliance or application interface. No user interaction, prior authentication, or elevated privileges are needed. An attacker sends a crafted request to the vulnerable endpoint to invoke the unauthenticated function and modify appliance behavior or configuration. Because SCG appliances often broker connectivity between internal infrastructure and external Dell services, exposure of this function may enable lateral movement or tampering with managed device telemetry.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Refer to the Dell Security Update DSA-2026-382 for vendor-specific technical details.

Detection Methods for CVE-2026-79645

Indicators of Compromise

Unexpected inbound HTTP or HTTPS requests to Dell SCG management interfaces from unauthorized source IP addresses.
Configuration or policy changes on the SCG appliance without a corresponding authenticated administrator session in audit logs.
New or modified remote support sessions, scripts, or telemetry destinations that were not initiated by an operator.

Detection Strategies

Review SCG audit and access logs for API or web calls that succeed without an associated authenticated user identity.
Compare running SCG appliance and application versions against the fixed builds 5.36.00.16 and 5.36.00.00 to identify vulnerable instances.
Correlate network flow data with SCG management ports to detect access from outside expected administrative subnets.

Monitoring Recommendations

Forward SCG appliance logs to a centralized SIEM and alert on administrative actions lacking user attribution.
Monitor egress connections from SCG appliances for deviations from established Dell support endpoints.
Track version and patch state of all SCG deployments through configuration management or vulnerability scanning.

How to Mitigate CVE-2026-79645

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later, and Dell SCG 5.0 Application to version 5.36.00.00 or later.
Restrict network access to SCG management interfaces to trusted administrative networks only.
Audit SCG configuration and remote support activity for evidence of unauthorized changes prior to patching.

Patch Information

Dell has released fixed versions addressing this vulnerability. Detailed remediation guidance, including download locations for the updated SCG Appliance and Application builds, is available in the Dell Security Update DSA-2026-382. Administrators should apply the update following Dell's documented upgrade procedure for SCG Virtual Edition.

Workarounds

Place SCG appliances behind a firewall or jump host that enforces source-IP allowlisting for management access.
Segment SCG appliances onto an isolated management VLAN with no direct exposure to user or internet-facing networks.
Disable or block network reachability to the affected function until the patch can be applied, where operationally feasible.

bash

# Example: restrict inbound access to SCG management interface using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP