CVE-2026-79692: Dell Secure Connect Gateway Path Traversal

CVE-2026-79692 Overview

CVE-2026-79692 is an External Control of File Name or Path vulnerability [CWE-73] affecting Dell Secure Connect Gateway (SCG) 5.0. The flaw impacts SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00. An unauthenticated remote attacker can supply attacker-controlled input that influences filesystem paths processed by the appliance, resulting in unauthorized filesystem access. Dell published fixed builds in security advisory DSA-2026-382.

Critical Impact
Unauthenticated remote attackers can access the appliance filesystem, exposing configuration files, credentials, and telemetry data stored on Dell SCG deployments.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell SCG Virtual Edition (per advisory DSA-2026-382)

Discovery Timeline

2026-09-09 - CVE CVE-2026-79692 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79692

Vulnerability Analysis

Dell Secure Connect Gateway is the remote support and telemetry appliance used by enterprise Dell customers to relay diagnostics, logs, and dispatch data to Dell support infrastructure. The appliance exposes network-facing services for management and file operations. In vulnerable releases, one or more of these services accept a filename or path parameter from the client and use it directly in filesystem operations without sufficient validation or canonicalization.

Because exploitation requires no authentication and no user interaction, an attacker with network reach to the SCG management interface can read or interact with files outside the intended directory scope. The confidentiality, integrity, and availability impact is bounded to what the service account can access, but this typically includes support bundles, logs, and configuration artifacts sensitive to the customer environment.

Root Cause

The root cause is improper neutralization of externally supplied path input, classified as [CWE-73] External Control of File Name or Path. The service constructs a filesystem path from request data without enforcing an allowlist of directories, rejecting traversal sequences such as ../, or resolving the canonical path before use.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted request to the SCG management endpoint containing a manipulated filename or path parameter. The appliance then performs the file operation on the attacker-specified path, disclosing file contents or interacting with unintended filesystem locations.

No public proof-of-concept exploit or exploit-database entry is available for CVE-2026-79692 at the time of publication. Refer to the Dell Security Update DSA-2026-382 for vendor technical details.

Detection Methods for CVE-2026-79692

Indicators of Compromise

Unexpected HTTP or API requests to Dell SCG management endpoints containing path-traversal sequences such as ../, encoded variants (%2e%2e%2f), or absolute paths like /etc/.
Access log entries showing unauthenticated requests referencing sensitive files including configuration, credential stores, or private keys on the SCG appliance.
Outbound data flows from the SCG appliance to non-Dell destinations following anomalous inbound requests.

Detection Strategies

Inspect SCG web server and application logs for filename parameters containing traversal characters or paths outside the expected working directory.
Deploy network intrusion detection signatures that flag path-traversal patterns targeting SCG management URLs and API routes.
Compare running SCG appliance and application versions against fixed builds 5.36.00.16 and 5.36.00.00 to identify unpatched instances.

Monitoring Recommendations

Forward SCG appliance logs to a centralized SIEM or data lake and alert on anomalous file access patterns from unauthenticated sessions.
Monitor management interface exposure and alert if the SCG appliance becomes reachable from untrusted network segments or the public internet.
Track process and file integrity on the SCG virtual appliance to detect unexpected reads of sensitive configuration files.

How to Mitigate CVE-2026-79692

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later and SCG 5.0 Application to 5.36.00.00 or later as directed in DSA-2026-382.
Restrict network access to the SCG management interface so only trusted administrative subnets can reach it.
Review recent access logs on the appliance for evidence of path-traversal attempts and rotate any credentials that may have been exposed.

Patch Information

Dell has released fixed builds in advisory DSA-2026-382. Customers should follow the vendor upgrade procedure for both the SCG Appliance (Virtual Edition) and the SCG Application components. Verify the running version after upgrade using the SCG administration console.

Workarounds

Place the SCG appliance behind a firewall or reverse proxy that restricts inbound requests to authorized management hosts only.
Disable or filter access to any non-essential file-handling endpoints exposed by the SCG management interface until patches are applied.
Segment the SCG virtual appliance onto a dedicated management VLAN with strict egress controls to limit post-exploitation reach.

bash

# Example: restrict SCG management interface to a trusted admin subnet using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP