CVE-2026-80164: Dell Secure Connect Gateway Auth Bypass Flaw

CVE-2026-80164 Overview

CVE-2026-80164 is an Improper Certificate Validation vulnerability [CWE-295] in Dell Secure Connect Gateway (SCG) 5.0. The flaw affects both the appliance and application distributions and enables unauthenticated remote attackers to intercept or manipulate trusted communications. Dell rates the issue with a CVSS 3.1 base score of 9.1. Exploitation does not require user interaction or prior authentication, exposing confidentiality and integrity of data handled by the gateway.

Critical Impact
An unauthenticated remote attacker positioned on the network can bypass certificate validation and gain unauthorized access to data or systems trusted by the Secure Connect Gateway.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell SCG Virtual Edition deployments referenced in advisory DSA-2026-382

Discovery Timeline

2026-09-07 - CVE-2026-80164 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80164

Vulnerability Analysis

Dell Secure Connect Gateway acts as a communication broker between customer infrastructure and Dell backend services for telemetry, remote support, and firmware delivery. The gateway performs Transport Layer Security (TLS) connections to remote endpoints as part of its normal operation. CVE-2026-80164 arises because SCG does not correctly validate the X.509 certificates presented by remote peers.

An attacker with network access between the gateway and its trusted endpoints can present a forged or mismatched certificate that the gateway accepts. Because the gateway trusts the resulting session, the attacker can read sensitive data in transit or inject manipulated responses. The vulnerability affects both the appliance and application form factors of SCG 5.0.

Root Cause

The root cause is Improper Certificate Validation [CWE-295]. The gateway either fails to verify the certificate chain against a trusted authority, does not enforce hostname matching, or accepts certificates outside their validity conditions. Any of these gaps break the trust guarantee that TLS is intended to provide.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An adversary in a man-in-the-middle position between SCG and its remote peers can intercept the TLS handshake and substitute an attacker-controlled certificate. Once the gateway completes the handshake, the attacker can observe or modify traffic that the gateway treats as authenticated. See the Dell Security Update DSA-2026-382 for vendor-supplied technical detail.

Detection Methods for CVE-2026-80164

Indicators of Compromise

Unexpected TLS certificates presented to the gateway that do not chain to Dell-issued or customer-approved certificate authorities.
Outbound connections from the SCG host to IP addresses or hostnames outside the documented Dell service ranges.
Anomalous configuration changes, credential resets, or firmware update requests originating through SCG-managed sessions.

Detection Strategies

Monitor TLS sessions from the SCG appliance and compare presented certificate fingerprints against a known-good baseline of Dell endpoints.
Alert on repeated TLS renegotiation, downgrade attempts, or handshake anomalies on traffic sourced from the gateway.
Correlate SCG process activity with unexpected DNS resolutions or proxy traversal events that could indicate network interposition.

Monitoring Recommendations

Enable verbose logging on the SCG appliance and forward logs to a centralized SIEM for retention and correlation.
Baseline outbound destinations from the gateway and generate alerts for new endpoints or certificate authorities.
Review Dell support session records for unexpected remote access, script execution, or firmware operations initiated through the gateway.

How to Mitigate CVE-2026-80164

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later, and Dell SCG 5.0 Application to version 5.36.00.00 or later.
Restrict outbound network paths from the SCG host so that only documented Dell service endpoints are reachable.
Rotate credentials, API tokens, and support session artifacts that may have traversed the gateway before patching.

Patch Information

Dell has published fixes in advisory DSA-2026-382. Administrators should apply the updated appliance image or application package and validate the running version after upgrade. Reference the Dell Security Update DSA-2026-382 for release artifacts and upgrade instructions.

Workarounds

Place the SCG appliance behind a network segment that enforces strict egress filtering to Dell service endpoints only.
Terminate SCG outbound traffic through a monitored TLS inspection proxy that validates upstream certificates independently.
Disable or pause non-essential SCG features such as remote scripting or firmware delivery until the patched version is deployed.

bash

# Verify installed SCG version after upgrade
scgcli system version

# Confirm gateway is running a fixed release
# Expected: 5.36.00.16 (Appliance) or 5.36.00.00 (Application) or later