CVE-2026-79636

Improper TLS Certificate Validation with Host Mismatch in Dell Secure Connect Gateway

Published Sep 9, 2026 CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Description

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Validation of Certificate with Host Mismatch vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Analysis

Technical impact

This vulnerability permits an attacker to bypass TLS hostname verification by supplying a forged certificate that appears to match the expected identity, allowing the attacker to establish a trusted session with the gateway without authentication and gain unauthorized access to the device's management interface and potentially the connected network.

Affected Systems

Dell Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16 and Dell Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00 are affected. Newer releases of these products incorporate the certificate validation fix.

Risk and Exploitability

The CVSS score of 7.0 reflects medium severity. EPSS data is unavailable and the vulnerability is not listed in CISA KEV, so the exploitation likelihood is unknown at present. An unauthenticated attacker with remote network access can exploit the flaw by presenting a forged certificate during the TLS handshake, leveraging the lack of hostname validation to establish a privileged session.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Dell

Secure Connect Gateway 5.0 - Application

unaffected

Version	Status	Constraints
`0`	affected	< 5.36.00.00 or later

Dell

Secure Connect Gateway 5.0 - Appliance

unaffected

Version	Status	Constraints
`0`	affected	< 5.36.00.16 or later

Configuration 1 [-]

OR	cpe:2.3:a:dell:secure_connect_gateway:::::application:::*
	cpe:2.3:a:dell:secure_connect_gateway:::::virtual:::*

No data.

Vendor Product Versions

Dell

Secure Connect Gateway

Version	Status	Scheme	Platform
`[0,5.36.00.00)`	affected	generic	—
`[0,5.36.00.16)`	affected	generic	—

Dell

Secure Connect Gateway Appliance

Version	Status	Scheme	Platform
`[0,5.36.00.16)`	affected	generic	—

Dell

Secure Connect Gateway Application

Version	Status	Scheme	Platform
`[0,5.36.00.00)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply Dell Security Advisory DSA-2026-382 to upgrade the appliance to version 5.36.00.16 and the application to version 5.36.00.00, which corrects the certificate validation issue.
Reconfigure the gateway to enforce strict TLS hostname verification, ensuring that client certificates must match the expected hostnames and preventing forged certificates from being accepted.
If a patch cannot be applied immediately, temporarily disable external inbound TLS interfaces or apply strict ingress filtering to block untrusted connections until the vulnerability is mitigated.

Generated by OpenCVE AI on September 9, 2026 at 12:30 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.205% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities

History

Sep 13, 2026 8:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dell secure Connect Gateway Appliance Dell secure Connect Gateway Application
Vendors & Products		Dell secure Connect Gateway Appliance Dell secure Connect Gateway Application

Sep 9, 2026 8:30 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Dell Dell secure Connect Gateway
CPEs		cpe:2.3:a:dell:secure_connect_gateway:::::application:::* cpe:2.3:a:dell:secure_connect_gateway:::::virtual:::*
Vendors & Products		Dell Dell secure Connect Gateway

Sep 9, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 9, 2026 1:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		Improper TLS Certificate Validation with Host Mismatch in Dell Secure Connect Gateway

Sep 9, 2026 8:15 AM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Validation of Certificate with Host Mismatch vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
Weaknesses		CWE-297
References		https://www.dell.com/support/kbdoc/en-in/000503426/dsa-2026-382-security-update-for-dell-secure-connect-gateway-virtual-edition-multiple-vulnerabilities
Metrics		cvssV3_1 `{'score': 7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L'}`