DELL has patched multiple critical flaws in its Secure Connect Gateway (SCG) around the end of August 2026, with CVE-2026-80172 rated at 9.8 on the CVSS scale. The Dell advisory notes two additional high-severity bugs (CVE-2026-61410 and CVE-2026-80238) that could allow remote code execution and a root-level escape via an exposed Docker socket. Dell SCG 5.0 Appliance builds before 5.36.00.16 and SCG 5.0 Application builds before 5.36.00.00 are affected. Dell reports no active exploitation or public PoC at this time, but patches are available and users are urged to apply them promptly.
The most severe issue (CVE-2026-80172) enables an unauthenticated attacker to forge ADMIN access and refresh tokens by repeatedly reusing a captured request, with no nonce validation or time limit to requests. The other two flaws broaden the risk: CVE-2026-61410 allows remote command execution through crafted requests that bypass code-execution restrictions, and CVE-2026-80238 lets a low-privileged user abuse an exposed Docker socket to achieve root access and container escape.
In practice, organisations should upgrade both Appliance and Application components to 5.36.00.16 or later and 5.36.00.00 or later respectively, and restrict SCG console network access until all units are patched. Dell’s security advisory (DSA-2026-382) lists about 100 fixes in total, but this report focuses on the three critical vulnerabilities.