CVE-2026-80127

Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application contain an OS command injection flaw (CWE-78) in which special elements are not properly neutralized before being passed to the operating system. A remote attacker who already holds high-privileged access to the SCG management interface can trigger the flaw by injecting commands into that interface, which are then executed on the underlying host. Successful exploitation breaks the attacker out of the application context into OS-level execution, yielding elevation of privileges with high impact on confidentiality, integrity, and availability (CVSS 3.1 7.2, AV:N/AC:L/PR:H). Organizations running SCG 5.0 Appliance versions prior to 5.36.00.16 or SCG 5.0 Application versions prior to 5.36.00.00 are affected. Exploitation has not been confirmed: there is no entry in CISA's Known Exploited Vulnerabilities catalog, no known public proof-of-concept, and EPSS currently assigns a modest 0.9% probability of exploitation within 30 days.

What to do: Upgrade SCG 5.0 Appliance to 5.36.00.16 or later and SCG 5.0 Application to 5.36.00.00 or later. Because exploitation requires high-privileged credentials, restrict the management interface to trusted administrative networks, minimize the number of admin accounts, and audit local accounts on exposed gateways. Review appliance logs for unexpected command execution or unfamiliar administrative activity until the upgrade is complete.