CVE-2026-78488: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Dell Secure Connect Gateway 5.0 - Application

CVE-2026-78488 describes an OS Command Injection vulnerability in Dell Secure Connect Gateway 5.0 Application and Appliance versions prior to 5.36.00.00 and 5.36.00.16 respectively. The vulnerability arises from improper neutralization of special elements used in OS commands, allowing a low privileged remote attacker to execute commands on the affected system. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact.

Successful exploitation could lead to unauthorized execution of OS commands by a low privileged remote attacker, potentially compromising confidentiality of the system. There is no indication of impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the Dell vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Dell's security advisories for updates. Until a fix is available, restrict remote access to the affected systems and apply network-level controls to limit exposure.