CVE-2026-79965: Dell Secure Connect Gateway Auth Bypass

CVE-2026-79965 Overview

CVE-2026-79965 affects Dell Secure Connect Gateway (SCG) 5.0, a remote support and telemetry appliance used across Dell enterprise infrastructure. The flaw is classified as External Control of Critical State Data [CWE-625]. An unauthenticated remote attacker can manipulate state data exposed by the appliance to obtain unauthorized access to information the gateway processes.

Dell published the fix in advisory DSA-2026-382, addressing multiple issues in the SCG virtual edition. Affected releases include SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00.

Critical Impact
An unauthenticated network attacker can influence critical state data on the appliance, leading to disclosure of information handled by Dell Secure Connect Gateway.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell Secure Connect Gateway Virtual Edition

Discovery Timeline

2026-09-09 - CVE CVE-2026-79965 published to NVD
2026-09-09 - Last updated in NVD database
2026 - Dell releases security patch via advisory DSA-2026-382

Technical Details for CVE-2026-79965

Vulnerability Analysis

Dell Secure Connect Gateway mediates telemetry, remote support sessions, and dispatch workflows between customer environments and Dell services. The affected versions expose critical state data that an external, unauthenticated caller can influence over the network. Because the gateway relies on this state to make trust or routing decisions, an attacker who alters it can obtain information the appliance would otherwise restrict.

The issue maps to CWE-625: Permissive Regular Expression in NVD's mapping, but Dell describes it as External Control of Critical State Data. The impact is limited to confidentiality; integrity and availability are unaffected per Dell's assessment. No authentication or user interaction is required to exploit the flaw.

Root Cause

The root cause is the appliance's reliance on client-supplied values to populate or select critical runtime state. When these values are not validated or bound to a trusted server-side context, an attacker can substitute crafted state that changes how the gateway handles subsequent requests. This allows disclosure of data associated with sessions or resources the attacker does not own.

Attack Vector

Exploitation is remote and network-based. An attacker who can reach the SCG management or telemetry endpoints sends requests that manipulate the externally controlled state parameter. No credentials are required. Successful exploitation grants unauthorized read access to information exposed by the appliance. Dell has not published exploit details, and no public proof-of-concept exists as of the disclosure date.

See the Dell Security Update DSA-2026-382 for vendor-provided technical context.

Detection Methods for CVE-2026-79965

Indicators of Compromise

Unexpected HTTP requests to SCG management or API endpoints from unauthenticated sources
Access log entries containing manipulated session, tenant, or resource identifiers that do not match issued values
Outbound responses from the SCG appliance containing data unrelated to the requesting client context

Detection Strategies

Compare SCG version output against the fixed builds 5.36.00.16 (Appliance) and 5.36.00.00 (Application) to identify vulnerable instances
Alert on requests to SCG endpoints originating from network segments that should not have access to the management plane
Correlate authentication logs with data-return volume to identify unauthenticated sessions that retrieve non-trivial payloads

Monitoring Recommendations

Forward SCG appliance access, error, and audit logs to a centralized SIEM for review
Baseline normal API request patterns from Dell services and flag deviations
Monitor for repeated probing of state-carrying parameters such as identifiers, tokens, or reference keys in URL and body fields

How to Mitigate CVE-2026-79965

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later
Upgrade Dell SCG 5.0 Application to version 5.36.00.00 or later
Restrict network access to the SCG management interface to trusted administrative subnets only
Review appliance logs for unauthenticated access attempts since the appliance was deployed

Patch Information

Dell published fixed builds through advisory DSA-2026-382. Apply the update using the standard SCG upgrade workflow described in the Dell knowledge base article. The advisory addresses multiple vulnerabilities in the virtual edition, so a single upgrade cycle resolves all covered issues.

Workarounds

Place the SCG appliance behind a network access control list that permits only required administrative hosts and Dell service endpoints
Terminate inbound connections at a reverse proxy that enforces authentication before requests reach the appliance
Isolate the SCG management VLAN from general user networks until the patched version is deployed

bash

# Example: restrict SCG management access with iptables to a trusted admin subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP