CVE-2026-79636

Dell Secure Connect Gateway (SCG) 5.0 fails to properly validate that the certificate presented by a remote endpoint matches the expected host (CWE-297, Improper Validation of Certificate with Host Mismatch). An unauthenticated remote attacker who can intercept or spoof the hosts the gateway communicates with — typically requiring a man-in-the-middle or network-spoofing position, consistent with the high attack complexity in the CVSS vector — could exploit this to gain unauthorized access, with potential for high confidentiality impact plus low integrity and availability impact. Affected deployments are Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00. As of this analysis there is no evidence of exploitation: the flaw is not in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade SCG 5.0 Appliance to 5.36.00.16 or later and SCG 5.0 Application to 5.36.00.00 or later, and verify the running version in the gateway's management interface. As an interim mitigation, restrict network access to and from the gateway and ensure the network path to its remote endpoints cannot be intercepted by untrusted parties. Monitor Dell's security advisory for updates, since no public exploit or in-the-wild exploitation is currently known.