CVE-2026-79946: CWE-87: Improper Neutralization of Alternate XSS Syntax in Dell Secure Connect Gateway 5.0 - Application
Affects Dell Secure Connect Gateway 5.0 - ApplicationSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium : update Dell Secure Connect Gateway 5.0 - Application when convenient.
Data as of 10/24/2026, 17:08:27 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 27% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| DellSecure Connect Gateway 5.0 - Application | Affected
| Fixed in
|
| DellSecure Connect Gateway 5.0 - Appliance | Affected
| Fixed in
|
AI-suggested
Until an official fix is available, restrict remote access to the affected Dell Secure Connect Gateway 5.0 Application and Appliance versions. Monitor vendor communications for updates on patches or mitigations.
Description
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script injection.
Impact
An unauthenticated remote attacker could exploit this vulnerability to inject malicious scripts, potentially leading to limited confidentiality impact. There is no reported impact on integrity or availability. The vulnerability could be used to execute scripts in the context of the affected application, which may lead to information disclosure or session manipulation.