CVE-2026-80172: Dell Secure Connect Gateway Auth Bypass

CVE-2026-80172 Overview

CVE-2026-80172 is an Insufficient Verification of Data Authenticity vulnerability [CWE-345] in Dell Secure Connect Gateway (SCG) 5.0. The flaw affects SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00. An unauthenticated remote attacker can replay a captured request to repeatedly generate ADMIN access and refresh tokens. The absence of nonce validation and request time limits allows indefinite reuse of the captured request. Dell has published advisory DSA-2026-382 and recommends immediate upgrade.

Critical Impact
Unauthenticated remote attackers can replay captured requests to mint valid ADMIN tokens indefinitely, achieving full administrative control of the Secure Connect Gateway.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance (Virtual Edition) versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
Dell SCG deployments exposing the vulnerable authentication endpoint to network-reachable clients

Discovery Timeline

2026-09-09 - CVE-2026-80172 published to NVD
2026-09-09 - Last updated in NVD database
DSA-2026-382 - Dell releases security update for Secure Connect Gateway Virtual Edition

Technical Details for CVE-2026-80172

Vulnerability Analysis

Dell Secure Connect Gateway acts as the communication broker between customer environments and Dell support back-end services. The vulnerable authentication flow accepts a request that produces ADMIN access and refresh tokens without validating request freshness or uniqueness. An attacker who observes or captures a single valid request can resubmit it to obtain administrative tokens on demand. Because the tokens grant ADMIN privileges, successful exploitation compromises confidentiality, integrity, and availability of the gateway and the systems it manages.

Root Cause

The root cause is Insufficient Verification of Data Authenticity [CWE-345]. The affected endpoint does not include or verify a nonce, timestamp, or single-use token binding to prove that a request is fresh and originated from an authenticated caller. Without these controls, the server cannot distinguish a legitimate submission from a replay. Any captured request retains its validity indefinitely, functioning as a persistent credential for ADMIN token issuance.

Attack Vector

Exploitation requires network access to the SCG management interface and a single captured request, obtainable through network interception, log exposure, or proxy artifacts. The attacker resends the captured request to the token issuance endpoint and receives ADMIN access and refresh tokens in the response. Refresh tokens extend the attacker's foothold beyond the lifetime of individual access tokens. From this position, the attacker can pivot to managed systems, alter gateway configuration, and exfiltrate telemetry.

No public proof-of-concept code is available. See the Dell Security Update DSA-2026-382 for vendor-provided technical details.

Detection Methods for CVE-2026-80172

Indicators of Compromise

Repeated identical HTTP requests to the SCG authentication or token endpoint originating from the same or rotating source addresses.
Multiple ADMIN token issuance events within short time windows without corresponding interactive administrator logins.
Refresh token usage from IP addresses or user agents that do not match known administrator sessions.
Configuration changes, new user creation, or connector modifications outside of scheduled change windows.

Detection Strategies

Enable verbose authentication and API access logging on the SCG appliance and forward events to a centralized SIEM.
Alert on high-frequency token issuance requests with identical payload signatures or replayed request identifiers.
Correlate ADMIN token grants against approved administrator source networks and time-of-day baselines.

Monitoring Recommendations

Monitor network traffic to the SCG management interface for anomalous request volumes and repeated payloads.
Track token issuance and refresh operations, alerting when the same request signature produces multiple tokens.
Review outbound connections from the SCG to managed systems for unexpected administrative actions.

How to Mitigate CVE-2026-80172

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later, and SCG 5.0 Application to 5.36.00.00 or later, per Dell advisory DSA-2026-382.
Restrict network access to the SCG management interface to trusted administrative subnets using firewall or network ACLs.
Revoke and rotate any existing ADMIN access and refresh tokens after patching to invalidate replayed credentials.
Audit SCG configuration and connected system activity for unauthorized changes made prior to remediation.

Patch Information

Dell has released fixed versions addressing CVE-2026-80172. Refer to the Dell Security Update DSA-2026-382 for download links, upgrade procedures, and the full list of resolved issues in the Virtual Edition release.

Workarounds

Place the SCG management interface behind a VPN or jump host and block direct internet exposure.
Enforce network segmentation so only designated administrator workstations can reach the SCG authentication endpoints.
Increase logging fidelity and shorten token lifetime settings where configurable until patching is complete.

bash

# Example: restrict access to the SCG management interface with iptables
# Replace 10.10.20.0/24 with your administrator subnet and <SCG_IP> with the gateway address
iptables -A INPUT -p tcp -d <SCG_IP> --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp -d <SCG_IP> --dport 443 -j DROP