Dell has identified three severe vulnerabilities within its Secure Connect Gateway 5.0 platform, which could be exploited by attackers to gain unauthorized access, execute remote commands, and obtain root-level control over impacted systems. These vulnerabilities affect versions of the Secure Connect Gateway Appliance earlier than 5.36.00.16 and Application versions earlier than 5.36.00.00. The potential impact is significant, as Secure Connect Gateway is used by organizations to connect their Dell infrastructure with Dell support for monitoring and diagnostics. A breach could therefore allow attackers to infiltrate environments that house critical enterprise infrastructure.

The most critical of these issues, identified as CVE-2026-80172, involves insufficient data-authenticity verification and carries a CVSS score of 9.8. This flaw can be exploited by an unauthenticated remote attacker to create and refresh administrator access tokens repeatedly, due to the absence of nonce validation and request time limits. Another vulnerability, CVE-2026-61410, rated 9.4 on the CVSS scale, involves missing authorization. An attacker could bypass code execution restrictions by sending a specially crafted request, potentially leading to unauthorized remote command execution. The third flaw, CVE-2026-80238, with a CVSS score of 9.3, involves execution with unnecessary privileges and requires local access. An attacker with SSH access could exploit an exposed Docker socket to gain root-level privileges.

Dell has urged users to upgrade affected versions immediately to mitigate these risks. Appliance installations should be updated to version 5.36.00.16 or later, and Application installations should be updated to version 5.36.00.00 or later. Additionally, security teams are advised to scrutinize Secure Connect Gateway logs for any suspicious activity related to token generation, API requests, remote command execution, and unauthorized SSH sessions. Restricting network access to management interfaces and monitoring SSH access is also recommended. Addressing these vulnerabilities promptly is crucial to prevent unauthorized access and potential compromise of host systems.