CVE-2026-79695: Dell Secure Connect Gateway DOS Vulnerability

CVE-2026-79695 Overview

CVE-2026-79695 affects Dell Secure Connect Gateway (SCG) 5.0, an appliance used to enable secure remote support and telemetry between Dell infrastructure and Dell support services. The vulnerability stems from Improper Handling of Highly Compressed Data, commonly known as a data amplification or decompression bomb weakness [CWE-409]. An unauthenticated remote attacker can send crafted compressed input that expands significantly on the server, exhausting system resources. Successful exploitation results in denial of service against the SCG instance, disrupting support connectivity and telemetry flows.

Critical Impact
Unauthenticated remote attackers can trigger denial of service on Dell SCG 5.0 appliances and applications, interrupting secure support channels for Dell infrastructure.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell SCG Virtual Edition deployments referenced in advisory DSA-2026-382

Discovery Timeline

2026-09-09 - CVE-2026-79695 published to the National Vulnerability Database
2026-09-09 - Dell publishes security update DSA-2026-382
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79695

Vulnerability Analysis

The flaw is categorized under [CWE-409] Improper Handling of Highly Compressed Data. SCG accepts compressed input over the network and decompresses it without enforcing bounds on the resulting expanded size. An attacker submits a small compressed payload that decompresses into a much larger volume of data. Processing this expanded data consumes disproportionate memory, CPU, or disk resources on the gateway. When resource limits are exhausted, the SCG service degrades or fails, breaking secure connectivity for Dell hardware support workflows.

Root Cause

The root cause is missing validation of decompression ratio and output size during handling of compressed request data. SCG trusts the compressed input length rather than enforcing a hard ceiling on decompressed output. Without a maximum expansion limit or streaming quota, a single request can trigger uncontrolled memory allocation and CPU consumption.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with reachability to the SCG management or ingest interface submits a compressed payload crafted to achieve a high compression ratio, such as a zip bomb or gzip bomb. The gateway attempts to decompress the payload in full, exhausting available resources and producing denial of service. The vulnerability affects confidentiality, integrity, and availability at a low level according to the published CVSS vector, with availability being the primary practical impact.

No public proof-of-concept code has been released. See the Dell Security Update DSA-2026-382 for vendor technical details.

Detection Methods for CVE-2026-79695

Indicators of Compromise

Sudden spikes in memory or CPU utilization on SCG appliances without corresponding legitimate workload increases
Repeated inbound HTTP or HTTPS requests carrying Content-Encoding: gzip or similarly compressed payloads from untrusted sources
SCG service restarts, out-of-memory events, or unresponsive management interfaces

Detection Strategies

Inspect network telemetry for requests with anomalously high decompression ratios reaching the SCG ingest endpoints
Correlate SCG process crashes and OOM-killer events with inbound traffic patterns to identify amplification attempts
Monitor SCG application logs for decompression errors, truncated payload warnings, and repeated failed processing events

Monitoring Recommendations

Enable resource utilization alerting on the SCG virtual appliance for memory, CPU, and disk consumption thresholds
Forward SCG system and application logs to a centralized analytics platform for baseline deviation analysis
Track external exposure of SCG management interfaces and alert on unexpected internet-facing reachability

How to Mitigate CVE-2026-79695

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later
Upgrade Dell SCG 5.0 Application to version 5.36.00.00 or later
Restrict network access to SCG management and ingest interfaces to trusted administrative networks only
Review perimeter firewall and reverse proxy rules to ensure SCG is not exposed to untrusted networks

Patch Information

Dell has released fixed builds through security advisory Dell Security Update DSA-2026-382. Administrators should apply appliance version 5.36.00.16 or application version 5.36.00.00 following Dell's documented upgrade procedure. Validate service health and confirm reestablishment of support connectivity after the update.

Workarounds

Place SCG behind a reverse proxy or web application firewall configured to reject requests exceeding a maximum body or decompressed size
Enforce network segmentation so only authorized internal management systems can reach SCG endpoints
Rate-limit inbound requests to SCG interfaces to reduce the impact of repeated amplification attempts until patching is complete

bash

# Example: restrict SCG management access to a trusted subnet using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP