Dell Secure Connect Gateway Critical Flaws Let Attackers Gain Unauthorized Access

Key Takeaways

• Dell has disclosed three critical vulnerabilities in its Secure Connect Gateway 5.0 platform.
• The flaws could enable unauthorized access, remote code execution, and root-level privilege escalation.
• Affected versions include Secure Connect Gateway 5.0 Appliance versions prior to 5.36.00.16 and Secure Connect Gateway 5.0 Application versions prior to 5.36.00.00.
• Patches are available, and immediate upgrades are strongly recommended by Dell.

Dell has issued a critical security alert regarding three severe vulnerabilities identified in its Secure Connect Gateway 5.0 platform. These flaws present significant risks, potentially allowing attackers to bypass authentication, execute arbitrary commands remotely, and achieve root-level control over compromised systems.

The vulnerabilities impact Dell Secure Connect Gateway 5.0 Appliance installations running versions older than 5.36.00.16, as well as Secure Connect Gateway 5.0 Application installations predating version 5.36.00.00.

Dell is urging all customers to apply the necessary updates without delay, emphasizing the potential for these issues to expose vital support-management infrastructure to severe compromise. The Secure Connect Gateway is a crucial tool for organizations, linking Dell infrastructure directly to Dell’s support services for critical functions like monitoring, diagnostics, and automated service requests. A successful attack on this platform could therefore provide adversaries with a strategic foothold within environments hosting essential enterprise infrastructure.

Critical Flaws Detailed

The most critical of the identified issues is tracked as CVE-2026-80172, an insufficient data-authenticity verification vulnerability with a CVSS score of 9.8. This flaw permits an unauthenticated remote attacker to exploit captured requests, repeatedly generating administrative access tokens and refresh tokens. According to Dell’s advisory, the affected implementation lacks proper nonce validation and request time limits. This oversight allows an attacker who intercepts a valid request to replay it indefinitely, potentially gaining persistent unauthorized administrative access without needing legitimate login credentials.

A second significant vulnerability, CVE-2026-61410, is an authorization bypass flaw rated 9.4 on the CVSS scale. This issue enables an unauthenticated remote attacker to craft and send a malicious request to the Secure Connect Gateway application. Successful exploitation of this flaw could bypass intended security restrictions, leading to remote command execution on the affected system. Such access would allow attackers to run malicious code, exfiltrate sensitive data, modify configurations, establish persistence, or move laterally within the network.

The third vulnerability, CVE-2026-80238, carries a CVSS score of 9.3 and concerns execution with excessive privileges. While requiring local access, this flaw could allow a low-privileged operator with SSH access to the Secure Connect Gateway host to escalate their privileges to root level. The root cause of this vulnerability is an exposed Docker socket. A low-privileged user can leverage this socket to gain access to the host environment without requiring a password.

Dell also highlighted that an attacker who compromises a service within the orchestrator container could exploit this same Docker socket to escape the container boundary and seize control of the underlying host system. Collectively, these vulnerabilities present multiple avenues for attackers to fully compromise affected Secure Connect Gateway deployments. This could involve obtaining administrator tokens via request replay, executing commands remotely through authorization bypass, or escalating privileges by exploiting the exposed Docker socket.

What You Should Do

• Immediately identify all Dell Secure Connect Gateway 5.0 Appliance and Application deployments within your organization.
• Upgrade Appliance installations to version 5.36.00.16 or later.
• Upgrade Application installations to version 5.36.00.00 or later.
• Review Secure Connect Gateway logs for any signs of suspicious token-generation activity, unusual API requests, unexpected remote command execution, or unauthorized SSH sessions.
• Restrict network access to all management interfaces of the Secure Connect Gateway to only trusted administrative networks.
• Limit and closely monitor all SSH access to the Secure Connect Gateway hosts.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.