CVE-2026-79961: Dell Secure Connect Gateway Auth Bypass

CVE-2026-79961 Overview

CVE-2026-79961 is a Missing Authentication for Critical Function vulnerability [CWE-306] affecting Dell Secure Connect Gateway (SCG) 5.0. The flaw exists in both the appliance and application editions of the product. An unauthenticated remote attacker can reach a critical function exposed by the gateway and obtain unauthorized access to information handled by the service. Dell addressed the issue in SCG 5.0 Appliance 5.36.00.16 and SCG 5.0 Application 5.36.00.00 through advisory DSA-2026-382.

Critical Impact
Remote, unauthenticated attackers can access a protected function of Dell Secure Connect Gateway without credentials, exposing confidential information handled by the appliance.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell Secure Connect Gateway Virtual Edition (covered under DSA-2026-382)

Discovery Timeline

2026-09-09 - CVE-2026-79961 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79961

Vulnerability Analysis

Dell Secure Connect Gateway is a remote support and telemetry appliance that connects Dell infrastructure to Dell backend services. The vulnerability exists because a critical function of the gateway is exposed without an authentication check. A remote attacker can invoke that function directly over the network. Successful exploitation yields unauthorized access to information the gateway processes, without requiring any prior credentials or user interaction. The confidentiality impact is limited in scope, and the vulnerability does not modify data or degrade availability of the appliance.

Root Cause

The root cause is classified under [CWE-306: Missing Authentication for Critical Function]. A sensitive endpoint or service on the SCG appliance does not enforce identity verification before servicing requests. This design gap allows any network-reachable client to interact with the function as if authenticated. Dell's fix in the 5.36.00.16 appliance build and 5.36.00.00 application build reintroduces the required authentication controls.

Attack Vector

Exploitation occurs over the network against the SCG management or service interface. No privileges, credentials, or user interaction are required. An attacker with routing access to the SCG host can issue a request to the affected function and receive information that should be restricted. Public proof-of-concept code is not available at time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available. Refer to the Dell Security Update DSA-2026-382 for vendor-supplied technical context.

Detection Methods for CVE-2026-79961

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to SCG management endpoints originating from unexpected internal or external hosts.
Access log entries showing successful responses to sensitive SCG service URIs without a preceding authentication event.
Outbound data flows from the SCG appliance to hosts not associated with Dell backend services.

Detection Strategies

Inventory all Dell Secure Connect Gateway 5.0 deployments and confirm build numbers against the fixed versions 5.36.00.16 (Appliance) and 5.36.00.00 (Application).
Baseline normal API traffic to the SCG appliance and alert on requests that bypass the authentication flow.
Correlate SCG access logs with identity provider logs to identify requests that lack a valid session context.

Monitoring Recommendations

Forward SCG appliance and web server logs to a centralized logging platform for retention and correlation.
Monitor network segments hosting SCG for unexpected inbound connections from user subnets or the internet.
Alert on new administrative sessions or configuration changes on the SCG appliance outside approved change windows.

How to Mitigate CVE-2026-79961

Immediate Actions Required

Upgrade SCG 5.0 Appliance to version 5.36.00.16 or later and SCG 5.0 Application to version 5.36.00.00 or later per DSA-2026-382.
Restrict network access to the SCG management interface to trusted administrative subnets only.
Review recent SCG access logs for unauthenticated interaction with sensitive endpoints prior to patching.

Patch Information

Dell has released fixed builds in advisory Dell Security Update DSA-2026-382. Apply the vendor-supplied updates using the standard SCG upgrade procedure and validate the running build after upgrade.

Workarounds

Place the SCG appliance behind a firewall or reverse proxy that enforces source-IP allowlists for management traffic.
Segment the SCG appliance onto a dedicated management VLAN with no direct user or internet reachability.
Where the appliance must remain exposed, front the management interface with an authenticating gateway until the patch is applied.

bash

# Example: restrict inbound access to the SCG appliance to an admin subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP