CVE-2026-78493

CVE-2026-78493 is an OS command injection flaw (CWE-77) in Dell Secure Connect Gateway 5.0, where the software fails to properly neutralize special shell characters before passing input to the operating system. A low-privileged attacker with local access to the gateway can submit crafted input containing shell metacharacters, causing arbitrary OS commands to be executed. Successful exploitation yields command execution on the appliance or application host, with confidentiality, integrity and availability all rated highly impacted (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U). It affects organizations running SCG 5.0 Appliance versions prior to 5.36.00.16 or SCG 5.0 Application versions prior to 5.36.00.00; these gateways are typically deployed in enterprise environments to broker support and telemetry connectivity with Dell. No exploitation has been reported: the flaw is not in CISA's KEV catalog and no public proof-of-concept is known.

What to do: Upgrade Dell SCG 5.0 Appliance to version 5.36.00.16 or later, or SCG 5.0 Application to version 5.36.00.00 or later. Because exploitation requires low-privileged local access, restrict local and management-interface access on the SCG host to trusted administrators and audit low-privileged local accounts. Check the deployed version in the SCG administration console to determine whether the fix is needed.