CVE-2026-80131: Dell Secure Connect Gateway Path Traversal

CVE-2026-80131 Overview

CVE-2026-80131 is a path traversal vulnerability [CWE-22] affecting Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application editions. The flaw allows an unauthenticated remote attacker to traverse restricted directories on the appliance. Successful exploitation can lead to remote code execution on the affected system. Dell tracks the fix under advisory DSA-2026-382.

Secure Connect Gateway is Dell's remote support and telemetry gateway deployed inside enterprise networks. A compromise of this component provides attackers with a foothold on an internal management appliance that communicates with Dell infrastructure and monitored assets.

Critical Impact
An unauthenticated network attacker can achieve remote code execution on Dell SCG 5.0 appliances running versions prior to 5.36.00.16 (Appliance) or 5.36.00.00 (Application).

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell SCG Virtual Edition (per vendor advisory DSA-2026-382)

Discovery Timeline

2026-09-07 - CVE-2026-80131 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80131

Vulnerability Analysis

The vulnerability is classified as Improper Limitation of a Pathname to a Restricted Directory [CWE-22]. Dell SCG exposes network-accessible functionality that accepts file path input without sufficient normalization or validation. An attacker can supply crafted path sequences to reference files outside the intended base directory.

Because the flaw requires no authentication and is reachable over the network, exploitation can chain path traversal with file write or execution primitives to obtain remote code execution. The impact spans confidentiality, integrity, and availability of the appliance.

Root Cause

The underlying defect is insufficient sanitization of user-controlled path components before they are joined with a base directory and passed to file system operations. Sequences such as ../ are not neutralized, and canonicalization does not enforce that resolved paths remain within an allowlisted directory.

Attack Vector

An unauthenticated attacker sends crafted requests to the SCG service over the network. By manipulating path parameters, the attacker reads or writes files outside the expected directory scope. Where writable paths intersect with locations processed by the appliance (for example, scheduled tasks, web roots, or configuration loaders), the attacker escalates the primitive to code execution under the service account.

No public proof-of-concept exploit is currently listed in the enriched data, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog. Technical details are described in prose only; refer to the Dell Security Update DSA-2026-382 for vendor-provided information.

Detection Methods for CVE-2026-80131

Indicators of Compromise

Unexpected files written under SCG web-accessible or executable directories on the appliance.
HTTP or API requests to the SCG management interface containing ../, ..%2f, ..\, or URL-encoded traversal variants.
New or modified scheduled tasks, cron entries, or startup scripts on the SCG host outside of a scheduled patch window.
Outbound connections from the SCG appliance to non-Dell infrastructure.

Detection Strategies

Inspect reverse-proxy, load-balancer, and appliance access logs for path traversal sequences targeting SCG endpoints.
Correlate anomalous file system writes on the appliance with inbound requests from untrusted network segments.
Baseline the SCG process tree and alert on child processes spawned by the web or API service (for example, shells or interpreters).

Monitoring Recommendations

Forward SCG appliance logs and host telemetry to a centralized SIEM for retention and correlation.
Alert on authentication-free requests that produce successful file operations against sensitive paths.
Monitor egress from the SCG management VLAN and flag connections outside the documented Dell support endpoints.

How to Mitigate CVE-2026-80131

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later.
Upgrade Dell SCG 5.0 Application to version 5.36.00.00 or later.
Restrict network reachability of the SCG management interface to trusted administrative networks only.
Review appliance file systems, scheduled tasks, and outbound connections for signs of prior exploitation before patching.

Patch Information

Dell has released fixed builds documented in Dell Security Update DSA-2026-382. Administrators should apply the vendor-supplied update for the deployed edition (Appliance or Application) and validate the version string after the upgrade.

Workarounds

Place the SCG appliance behind a network access control list that permits only required administrative source addresses.
Terminate exposure of the SCG management interface to untrusted zones, including the internet, until the patch is applied.
Enable web application firewall rules that block traversal sequences (../, ..%2f, ..%5c) on paths fronting the SCG service.

bash

# Example iptables restriction limiting SCG management access to a trusted admin subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP