CVE-2026-78480

CVE-2026-78480 is a missing authentication for critical function flaw (CWE-306) in Dell Secure Connect Gateway (SCG) 5.0, affecting the Appliance prior to version 5.36.00.16 and the Application prior to version 5.36.00.00. An unauthenticated attacker with network access to the gateway can invoke critical functions that lack authentication checks, gaining unauthorized access; the published CVSS 3.1 vector (7.5, network vector, no privileges or user interaction required) scores the impact as availability-high with no direct confidentiality or integrity impact. Affected organizations are those running SCG 5.0, which is typically deployed as a virtual appliance or software gateway inside enterprise networks to provide connectivity between Dell infrastructure and Dell's support backend. There is currently no evidence of exploitation: the flaw is not in CISA's KEV catalog, has no known public proof-of-concept, and EPSS assigns it a low 0.3% probability of exploitation within 30 days.

What to do: Upgrade the SCG 5.0 Appliance to version 5.36.00.16 or later and the SCG 5.0 Application to version 5.36.00.00 or later. Until patched, restrict network access to the gateway so only management networks and required Dell connectivity endpoints can reach it, and inventory deployments to identify any SCG instances exposed to untrusted networks.