CVE-2026-80166: Dell SCG 5.0 Privilege Escalation Flaw

CVE-2026-80166 Overview

CVE-2026-80166 is an Improper Privilege Management vulnerability [CWE-269] affecting Dell Secure Connect Gateway (SCG) 5.0. The flaw impacts Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00. An unauthenticated attacker with local access to an affected system can exploit this weakness to elevate privileges. Dell disclosed the issue in security advisory DSA-2026-382, which addresses multiple vulnerabilities in the Secure Connect Gateway virtual edition.

Critical Impact
Successful exploitation grants an attacker elevated privileges on the SCG host, resulting in full compromise of confidentiality, integrity, and availability of the appliance.

Affected Products

Dell Secure Connect Gateway (SCG) 5.0 Appliance versions prior to 5.36.00.16
Dell Secure Connect Gateway (SCG) 5.0 Application versions prior to 5.36.00.00
Dell Secure Connect Gateway Virtual Edition (per DSA-2026-382)

Discovery Timeline

2026-09-07 - CVE-2026-80166 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-80166

Vulnerability Analysis

CVE-2026-80166 is an Improper Privilege Management flaw [CWE-269] in the Dell Secure Connect Gateway 5.0 platform. Dell SCG is a virtual appliance that brokers remote support connections between customer infrastructure and Dell backend services. Because SCG runs privileged services and manages secure tunnels, elevation of privileges on the appliance directly undermines the trust model of the remote support channel. Dell's advisory DSA-2026-382 documents this issue among multiple vulnerabilities addressed in the same release cycle.

Root Cause

The root cause is improper enforcement of privilege boundaries within the SCG 5.0 Appliance and Application code paths. A component accessible to a local, low-privileged actor performs actions using higher privileges without adequate authorization checks. This class of weakness typically arises from setuid binaries, misconfigured service accounts, insecure file permissions, or trusted invocation of helper processes that do not validate the caller.

Attack Vector

Exploitation requires local access to the SCG appliance and does not require prior authentication according to the CVE description. An attacker with the ability to execute code or interact with the affected component on the host can trigger the privilege escalation. User interaction is not required. Dell has not published exploitation details, and no public proof-of-concept is currently available.

Refer to the Dell Security Update DSA-2026-382 for vendor-supplied technical context.

Detection Methods for CVE-2026-80166

Indicators of Compromise

Unexpected creation of privileged processes or shells spawned by the SCG service account.
Modification of SCG configuration files, cron entries, or systemd units outside of scheduled updates.
New or altered local user accounts, SSH keys, or sudoers entries on the SCG appliance.
Anomalous outbound connections originating from the SCG virtual appliance following local logins.

Detection Strategies

Compare installed SCG Appliance and Application versions against the fixed builds 5.36.00.16 and 5.36.00.00.
Baseline expected process trees for SCG services and alert on child processes running as root or elevated accounts.
Monitor audit logs (auditd, /var/log/secure) for setuid executions and privilege transitions tied to SCG binaries.

Monitoring Recommendations

Forward SCG appliance logs to a centralized logging or SIEM platform for correlation with endpoint telemetry.
Enable file integrity monitoring on SCG binaries, configuration directories, and privileged scripts.
Track administrative logins and console sessions on the SCG virtual machine, alerting on off-hours activity.

How to Mitigate CVE-2026-80166

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later, and SCG 5.0 Application to 5.36.00.00 or later.
Restrict local and console access to the SCG virtual appliance to a minimal set of trusted administrators.
Review existing SCG accounts, SSH keys, and sudo entries for unauthorized additions before and after patching.
Isolate the SCG appliance on a management network segment with strict ingress and egress controls.

Patch Information

Dell has released fixed versions per advisory DSA-2026-382. Upgrade SCG 5.0 Appliance to 5.36.00.16 and SCG 5.0 Application to 5.36.00.00 or later. Follow Dell's upgrade guidance in the Dell Security Update DSA-2026-382 knowledge base article.

Workarounds

No vendor-supplied workaround is documented; applying the patch is the recommended remediation.
As a compensating control, limit shell and console access on the SCG host to reduce local attack surface.
Enforce multi-factor authentication on jump hosts and hypervisor consoles that reach the SCG appliance.

bash

# Verify installed SCG version on the appliance
cat /etc/scg-release 2>/dev/null || rpm -qa | grep -i scg

# Confirm upgraded build meets or exceeds fixed versions
# Appliance target: 5.36.00.16
# Application target: 5.36.00.00