CVE-2026-79638: CWE-693: Protection Mechanism Failure in Dell Secure Connect Gateway 5.0 - Application
Affects Dell Secure Connect Gateway 5.0 - ApplicationSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 26% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| DellSecure Connect Gateway 5.0 - Application | Affected
| Fixed in
|
| DellSecure Connect Gateway 5.0 - Appliance | Affected
| Fixed in
|
AI-suggested
Until an official fix is released, monitor vendor communications for updates. No specific mitigations or workarounds are provided in the available data.
Description
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script injection.
Impact
The vulnerability allows an unauthenticated remote attacker to inject scripts via improper neutralization of alternate XSS syntax, potentially leading to confidentiality loss. There is no indication of integrity or availability impact. No known active exploitation has been reported.
Summary
CVE-2026-79638 describes a protection mechanism failure in Dell Secure Connect Gateway 5.0, specifically an improper neutralization of alternate cross-site scripting (XSS) syntax. This vulnerability affects versions prior to 5.36.00.16 for the Appliance and prior to 5.36.00.00 for the Application. An unauthenticated attacker with remote access could exploit this flaw to inject malicious scripts, potentially impacting confidentiality. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and a confidentiality impact only. No official remediation level or patch information is currently available.