CVE-2026-79972: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Dell Secure Connect Gateway 5.0 - Application

CVE-2026-79972 is an SQL Injection vulnerability in Dell Secure Connect Gateway 5.0 Application and Appliance. Versions prior to 5.36.00.00 (Application) and 5.36.00.16 (Appliance) improperly neutralize special elements in SQL commands, allowing a high privileged remote attacker to execute unauthorized SQL queries. This can lead to unauthorized access and compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Successful exploitation could allow a high privileged remote attacker to execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive data, modification of data, and disruption of service. The impact affects confidentiality, integrity, and availability of the affected system.

The vendor has identified the affected versions but no explicit patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the Dell vendor advisory for current remediation guidance. Until a patch is available, restrict remote access to high privileged users and monitor for suspicious activity related to SQL commands.