CVE-2026-79965: CWE-625: Permissive Regular Expression in Dell Secure Connect Gateway 5.0 - Application
Affects Dell Secure Connect Gateway 5.0 - ApplicationSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 26% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| DellSecure Connect Gateway 5.0 - Application | Affected
| Fixed in
|
| DellSecure Connect Gateway 5.0 - Appliance | Affected
| Fixed in
|
AI-suggested
Until an official fix is released, monitor vendor communications for updates. No specific mitigations or workarounds are provided at this time.
Description
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of Critical State Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
Impact
An unauthenticated remote attacker could exploit this vulnerability to gain unauthorized access to the Dell Secure Connect Gateway 5.0 system. The impact is limited to confidentiality loss with no integrity or availability impact reported. This could potentially expose sensitive state data controlled externally by the attacker.
Summary
CVE-2026-79965 describes a vulnerability in Dell Secure Connect Gateway 5.0 Appliance and Application where permissive regular expressions lead to External Control of Critical State Data (CWE-625). This flaw could be exploited remotely without authentication to gain unauthorized access. The vulnerability affects versions prior to 5.36.00.16 for the Appliance and prior to 5.36.00.00 for the Application. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No vendor advisory or patch information is currently available.