CVE-2026-78491

Improper Certificate Validation Enabling Unauthorized Access in Dell Secure Connect Gateway 5.0

Published Sep 9, 2026 CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Description

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Analysis

Technical impact

The vulnerability is an Improper Certificate Validation flaw in Dell Secure Connect Gateway 5.0. An unauthenticated attacker who can reach the gateway remotely could exploit the flaw to bypass authentication checks, leading to unauthorized access to the appliance or application.

Affected Systems

Affected systems include Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16 and Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00. These versions are available as appliance or application deployments.

Risk and Exploitability

The flaw carries a CVSS score of 8.2, indicating high severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, unauthenticated access; an attacker could exploit the improper validation of certificates to gain unauthorized entry. The presence of CWE‑295 highlights the weakness in trust validation logic.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Dell

Secure Connect Gateway 5.0 - Application

unaffected

Version	Status	Constraints
`0`	affected	< 5.36.00.00 or later

Dell

Secure Connect Gateway 5.0 - Appliance

unaffected

Version	Status	Constraints
`0`	affected	< 5.36.00.16 or later

Configuration 1 [-]

OR	cpe:2.3:a:dell:secure_connect_gateway:::::application:::*
	cpe:2.3:a:dell:secure_connect_gateway:::::virtual:::*

No data.

Vendor Product Versions

Dell

Secure Connect Gateway

Version	Status	Scheme	Platform
`[0,5.36.00.00)`	affected	generic	—
`[0,5.36.00.16)`	affected	generic	—

Dell

Secure Connect Gateway Appliance

Version	Status	Scheme	Platform
`[0,5.36.00.16)`	affected	generic	—

Dell

Secure Connect Gateway Application

Version	Status	Scheme	Platform
`[0,5.36.00.00)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Dell DSA‑2026‑382 security update for Dell Secure Connect Gateway Virtual Edition, which includes the certificate validation fix.
Upgrade the appliance to version 5.36.00.16 or later and the application to 5.36.00.00 or later to ensure the vulnerability is patched.
If a patch cannot be applied immediately, restrict external access to the gateway to trusted networks and disable remote certificate validation for external connections as a temporary mitigation.

Generated by OpenCVE AI on September 9, 2026 at 10:07 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.272% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities

History

Sep 14, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 13, 2026 8:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dell secure Connect Gateway Appliance Dell secure Connect Gateway Application
Vendors & Products		Dell secure Connect Gateway Appliance Dell secure Connect Gateway Application

Sep 9, 2026 8:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dell Dell secure Connect Gateway
CPEs		cpe:2.3:a:dell:secure_connect_gateway:::::application:::* cpe:2.3:a:dell:secure_connect_gateway:::::virtual:::*
Vendors & Products		Dell Dell secure Connect Gateway

Sep 9, 2026 10:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Improper Certificate Validation Enabling Unauthorized Access in Dell Secure Connect Gateway 5.0

Sep 9, 2026 8:45 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
Weaknesses		CWE-295
References		https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'}`