CVE-2026-80239: Dell SCG Information Disclosure Vulnerability

CVE-2026-80239 Overview

CVE-2026-80239 affects Dell Secure Connect Gateway (SCG) 5.0, an appliance and application used to enable secure remote support and telemetry between Dell environments and Dell services. The flaw is an Exposure of Sensitive System Information Due to Uncleared Debug Information issue [CWE-1258]. Debug data left resident in the appliance can be read by an unauthenticated attacker with physical access to the system, resulting in information disclosure. The vulnerability affects Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00. Dell has published a security advisory and updated releases that clear the affected debug information.

Critical Impact
An unauthenticated attacker with physical access to a vulnerable Dell Secure Connect Gateway can read uncleared debug information and obtain sensitive system data.

Affected Products

Dell Secure Connect Gateway 5.0 Appliance (Virtual Edition) versions prior to 5.36.00.16
Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00
CPE: cpe:2.3:a:dell:secure_connect_gateway:*:*:*:*:application:*:*:* and cpe:2.3:a:dell:secure_connect_gateway:*:*:*:*:virtual:*:*:*

Discovery Timeline

2026-09-09 - CVE-2026-80239 published to NVD
2026-09-09 - Last updated in NVD database
2026-09-09 - Dell published advisory DSA-2026-382

Technical Details for CVE-2026-80239

Vulnerability Analysis

The vulnerability is classified under [CWE-1258], Exposure of Sensitive System Information Due to Uncleared Debug Information. Dell Secure Connect Gateway retains debug artifacts on the appliance after operational or diagnostic activity. These artifacts can contain configuration values, internal identifiers, or other system state that should not be readable outside a controlled debug session. Because the debug data is not cleared, an actor with local console or physical access to the appliance can retrieve it without authenticating.

The scope is limited to confidentiality. The vulnerability does not permit modification of system data or disruption of service by itself. Disclosed content can, however, support later stages of an intrusion, including credential reuse, targeted phishing against administrators, or reconnaissance against the wider Dell support fabric that SCG connects to.

Root Cause

The root cause is debug information left in place on the SCG appliance and application after use. Development or diagnostic code paths generate this data but do not sanitize or remove it before returning the system to a production state, so it remains accessible on the running appliance.

Attack Vector

Exploitation requires physical access to the SCG appliance. No authentication and no user interaction are required. An attacker with hands-on access to the console or the underlying host can read the exposed debug information directly. Network-based exploitation is not applicable.

No public proof-of-concept, exploit module, or in-the-wild activity has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-80239

Indicators of Compromise

Unexpected console sessions or out-of-band management access to the SCG appliance host.
Presence of debug files, core dumps, or diagnostic archives on the appliance that were not generated by an authorized support case.
Support bundles or log exports leaving the appliance outside of scheduled Dell support workflows.

Detection Strategies

Inventory all Dell SCG 5.0 deployments and confirm build numbers against the fixed versions 5.36.00.16 (Appliance) and 5.36.00.00 (Application).
Review hypervisor and datacenter access logs for physical or console access to hosts running SCG virtual appliances.
Audit filesystem contents of the SCG appliance for residual debug output following any diagnostic activity.

Monitoring Recommendations

Alert on new logins at the appliance console and on privileged access to the virtualization layer hosting SCG.
Track outbound transfers of diagnostic bundles from SCG and correlate against approved Dell support tickets.
Monitor changes to the SCG image version and validate that patched builds are deployed across all sites.

How to Mitigate CVE-2026-80239

Immediate Actions Required

Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later, and Dell SCG 5.0 Application to version 5.36.00.00 or later.
Restrict physical and hypervisor-level access to hosts running the SCG virtual appliance to a small set of named administrators.
Remove any residual debug bundles or diagnostic exports from the appliance filesystem after patching.

Patch Information

Dell has released fixed builds and documented them in advisory DSA-2026-382 – Security Update for Dell Secure Connect Gateway Virtual Edition. Apply the vendor update through the standard SCG update workflow and verify the reported build after reboot.

Workarounds

Enforce datacenter physical security controls and multi-person access requirements for racks hosting SCG hardware or hypervisors.
Disable or lock out unused console, serial, and remote KVM interfaces on the SCG host until patching is complete.
Encrypt the virtual disks backing the SCG appliance so that offline extraction of debug artifacts is not trivial.

bash

# Verify installed Dell SCG version against fixed builds
# Run from the SCG appliance shell after login
cat /etc/scg-release 2>/dev/null || scgctl version

# Expected minimum versions:
#   Appliance   >= 5.36.00.16
#   Application >= 5.36.00.00