CVE-2026-80130

Dell Secure Connect Gateway (SCG) 5.0 contains a relative path traversal flaw (CWE-23) that allows a low-privileged remote user to reference files outside the intended directory. By sending a crafted path that the gateway fails to normalize, the attacker can escape the application's working directory and achieve remote code execution on the SCG host. Successful exploitation carries high impact on confidentiality, integrity, and availability (CVSS 3.1 8.8) on a system that typically sits inside the customer network brokering support connectivity for Dell infrastructure. Users running SCG 5.0 Appliance before 5.36.00.16 or SCG 5.0 Application before 5.36.00.00 are affected. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known, and EPSS currently estimates only about a 0.3% chance of exploitation within 30 days.

What to do: Upgrade SCG 5.0 Appliance to 5.36.00.16 or later and SCG 5.0 Application to 5.36.00.00 or later per Dell's security advisory. Until patched, restrict gateway user and administrative access to trusted networks and review which low-privileged accounts can reach the SCG instance. Monitor Dell's advisory and threat reporting for updates, since no public PoC or in-the-wild exploitation is currently documented.