CVE-2026-80055: Dell Secure Connect Gateway LDAP Injection

CVE-2026-80055 Overview

CVE-2026-80055 is an LDAP Injection vulnerability affecting Dell Secure Connect Gateway (SCG) 5.0. The flaw exists in both the appliance and application distributions of the product. It stems from improper neutralization of special elements used in an LDAP query [CWE-90]. A remote attacker can send crafted input to influence LDAP query construction, leading to script injection within the application context.

Dell tracks this issue under advisory DSA-2026-382. The vulnerability affects Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00.

Critical Impact
A remote attacker can inject crafted content into backend LDAP queries, enabling script injection against the Dell Secure Connect Gateway management interface.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Both virtual edition and application deployments listed in CPE data

Discovery Timeline

2026-09-09 - CVE-2026-80055 published to NVD
2026-09-09 - Last updated in NVD database
2026-09-09 - EPSS score published at 0.211% (percentile 11.32)

Technical Details for CVE-2026-80055

Vulnerability Analysis

Dell Secure Connect Gateway integrates with directory services to support authentication and identity lookups. The vulnerable code path passes attacker-controllable input into an LDAP filter without proper escaping of special characters such as *, (, ), \, and NUL. This allows an attacker to alter the semantics of the LDAP query and influence which records are matched or returned.

The advisory further indicates the injection can produce script injection. Content returned from the manipulated LDAP query is reflected into a response context where it is interpreted as script. That secondary behavior expands the impact from directory query manipulation to client-side code execution against operators of the SCG interface.

The vulnerability is reachable over the network without authentication according to the description, though the CVSS vector reports high privileges required. This discrepancy suggests the injection point is exposed on an authenticated management surface while the payload itself does not require prior credentials to craft.

Root Cause

The root cause is missing input sanitization before values are concatenated into an LDAP query string. LDAP filter metacharacters retain their special meaning, which enables filter tampering and downstream reflected script injection [CWE-90].

Attack Vector

An attacker submits crafted input containing LDAP metacharacters to a request handler that constructs an LDAP query. The manipulated query returns attacker-influenced data, and that data is rendered without appropriate output encoding. See the Dell Security Update DSA-2026-382 for vendor-provided technical detail.

// No verified public proof-of-concept is available for CVE-2026-80055.
// Refer to Dell advisory DSA-2026-382 for vendor-supplied technical details.

Detection Methods for CVE-2026-80055

Indicators of Compromise

Web request logs containing LDAP filter metacharacters such as *)(, )(uid=, )(&, or \28 in parameters directed to Dell SCG endpoints
Unexpected LDAP query patterns in directory server logs originating from the SCG service account
HTTP responses from SCG reflecting attacker-supplied <script> fragments or other markup

Detection Strategies

Inspect SCG access logs for anomalous query parameters that include unescaped LDAP special characters
Correlate directory server audit logs with SCG request timestamps to identify malformed or broad LDAP filters
Alert on SCG HTTP responses that echo user-controlled input containing script tags or HTML event handlers

Monitoring Recommendations

Enable verbose LDAP query logging on the directory server for the SCG service principal
Forward SCG appliance and application logs to a central log platform and retain them for at least 90 days
Track SCG version inventory to confirm remediation status against 5.36.00.16 and 5.36.00.00

How to Mitigate CVE-2026-80055

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later
Upgrade Dell SCG 5.0 Application to version 5.36.00.00 or later
Restrict network access to the SCG management interface to trusted administrative networks only
Review directory server logs for anomalous LDAP filter activity prior to patch application

Patch Information

Dell has released fixed versions and documented the update in Dell Security Update DSA-2026-382. Apply the vendor-supplied builds 5.36.00.16 for the appliance and 5.36.00.00 for the application distribution.

Workarounds

No official workaround is published by Dell; upgrading is the supported remediation
Place the SCG management interface behind a VPN or jump host to reduce exposure until patched
Apply network ACLs limiting inbound access to the SCG interface to specific administrator source addresses

bash

# Example: restrict inbound access to the SCG management interface
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP