CVE-2026-78482: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Dell Secure Connect Gateway 5.0 - Application
Affects Dell Secure Connect Gateway 5.0 - ApplicationSource CVE Database V5
Not known to be exploited · CVSS 5.5 Medium : update Dell Secure Connect Gateway 5.0 - Application when convenient.
Data as of 10/24/2026, 17:08:27 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 2.4% chance of exploitation in 30 days – higher than 84% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| DellSecure Connect Gateway 5.0 - Application | Affected
| Fixed in
|
| DellSecure Connect Gateway 5.0 - Appliance | Affected
| Fixed in
|
AI-suggested
Until an official fix is available, restrict local access to trusted users only and monitor for suspicious activity. Do not rely on generic mitigations as the vendor has not provided specific guidance or patches at this time.
Description
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to command execution.
Impact
Successful exploitation allows a low privileged local attacker to execute arbitrary OS commands on the affected Dell SCG 5.0 system. This could lead to unauthorized disclosure of information (high confidentiality impact). There is no reported impact on integrity or availability. The attack requires local access and low privileges, with no user interaction needed.