CVE-2026-80123: Dell Secure Connect Gateway SSRF Vulnerability

CVE-2026-80123 Overview

CVE-2026-80123 is a Server-Side Request Forgery (SSRF) vulnerability in Dell Secure Connect Gateway (SCG) 5.0. The flaw affects SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00. An unauthenticated remote attacker can exploit the vulnerability to trigger a denial of service against affected appliances. The issue is tracked under CWE-918 and carries a network-based attack vector with no privileges or user interaction required.

Critical Impact
Unauthenticated remote attackers can abuse the SSRF flaw to cause denial of service on Dell Secure Connect Gateway appliances exposed to the network.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell Secure Connect Gateway Virtual Edition

Discovery Timeline

2026-09-09 - CVE CVE-2026-80123 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80123

Vulnerability Analysis

CVE-2026-80123 is a Server-Side Request Forgery vulnerability in Dell Secure Connect Gateway, the appliance Dell customers deploy for remote support telemetry and connectivity between Dell infrastructure and Dell back-end services. The vulnerable component accepts attacker-influenced input and issues outbound requests without adequate validation of the destination. Because exploitation requires no authentication and no user interaction, any network-reachable instance is exposed.

The practical impact documented by Dell is denial of service. The vulnerability does not directly disclose data or grant code execution, but forcing the appliance to issue attacker-controlled requests can exhaust resources or drive the service into an unresponsive state. Loss of the Secure Connect Gateway disrupts monitoring, entitlement checks, and automated support workflows for downstream Dell hardware.

Root Cause

The root cause is insufficient validation of URLs or hostnames used by a server-side request handler [CWE-918]. The application constructs and dispatches HTTP requests based on client-supplied input without enforcing an allowlist of permitted destinations, permitting an attacker to redirect outbound traffic toward arbitrary targets, including internal services or endpoints designed to trigger resource exhaustion.

Attack Vector

Exploitation occurs over the network against the exposed management interface of the Secure Connect Gateway. An unauthenticated attacker submits a crafted request that causes the appliance to issue a server-side HTTP request to an attacker-chosen endpoint. Repeated or malformed requests degrade availability and can render the appliance unresponsive. No specific exploit code is publicly available at the time of publication, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. Refer to the Dell Security Update Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-80123

Indicators of Compromise

Unexpected outbound HTTP or HTTPS requests originating from the Secure Connect Gateway appliance to destinations outside Dell's published support endpoints.
Sudden spikes in CPU, memory, or network socket usage on the SCG appliance without a corresponding change in managed device inventory.
Repeated 5xx responses or process restarts in SCG application logs correlated with inbound requests from untrusted networks.

Detection Strategies

Baseline the appliance's expected outbound destinations and alert on any deviation, since legitimate SCG traffic communicates with a well-known set of Dell endpoints.
Inspect web access logs on the SCG for unauthenticated requests carrying URL, host, or callback parameters that reference internal address ranges or unusual schemes.
Correlate network flow data with appliance availability metrics to identify DoS patterns consistent with SSRF abuse.

Monitoring Recommendations

Forward SCG application and system logs to a centralized log platform for retention and correlation.
Monitor availability of the SCG service and alert on unplanned restarts or extended unresponsive periods.
Track egress traffic from the SCG at the perimeter firewall and restrict destinations to Dell support infrastructure only.

How to Mitigate CVE-2026-80123

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later and Dell SCG 5.0 Application to version 5.36.00.00 or later.
Restrict network exposure of the Secure Connect Gateway management interface to trusted administrative networks only.
Review perimeter firewall policies to ensure the appliance cannot initiate arbitrary outbound connections to non-Dell destinations.

Patch Information

Dell has released fixed versions in advisory DSA-2026-382. Apply the updates documented in the Dell Security Update Advisory. Upgrading to the fixed versions is the vendor-recommended remediation.

Workarounds

Place the Secure Connect Gateway behind a segmented management network reachable only by authorized administrators until the patch is applied.
Enforce egress allowlisting so the appliance can reach only documented Dell support endpoints.
Increase monitoring on appliance availability and outbound traffic to detect exploitation attempts prior to patching.

bash

# Example egress allowlist enforcement using iptables on an upstream gateway
# Restrict SCG outbound traffic to documented Dell endpoints only
iptables -A FORWARD -s <SCG_IP> -p tcp --dport 443 -d <dell_support_endpoint> -j ACCEPT
iptables -A FORWARD -s <SCG_IP> -j DROP