CVE-2026-27101

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27101", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2026-02-17T18:05:21.466Z", "datePublished": "2026-04-01T07:27:49.317Z", "dateUpdated": "2026-04-02T03:55:54.422Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-04-01T07:28:06.066Z"}, "datePublic": "2026-03-23T06:30:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory Path Traversal", "type": "CWE"}]}], "affected": [{"vendor": "Dell", "product": "Secure Connect Gateway", "versions": [{"status": "affected", "version": "0", "lessThan": "5.34.00.00 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application version(s) 5.28.00.xx to 5.32.00.xx, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker within the management network could potentially exploit this vulnerability, leading to remote execution.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application version(s) 5.28.00.xx to 5.32.00.xx, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker within the management network could potentially exploit this vulnerability, leading to remote execution."}]}], "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000438589/dsa-2026-020-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"}}], "credits": [{"lang": "en", "value": "Dell would like to thank Ahmed Y. Elmogy for reporting this issue.", "type": "other"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-01T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-27101"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-02T03:55:54.422Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27101", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-01T14:35:40.674103Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-01T13:32:29.055Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "other", "value": "Dell would like to thank Ahmed Y. Elmogy for reporting this issue."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "Secure Connect Gateway", "versions": [{"status": "affected", "version": "0", "lessThan": "5.34.00.00 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-03-23T06:30:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000438589/dsa-2026-020-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application version(s) 5.28.00.xx to 5.32.00.xx, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker within the management network could potentially exploit this vulnerability, leading to remote execution.", "supportingMedia": [{"type": "text/html", "value": "Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application version(s) 5.28.00.xx to 5.32.00.xx, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker within the management network could potentially exploit this vulnerability, leading to remote execution.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory Path Traversal"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-04-01T07:28:06.066Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27101", "state": "PUBLISHED", "dateUpdated": "2026-04-02T03:55:54.422Z", "dateReserved": "2026-02-17T18:05:21.466Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2026-04-01T07:27:49.317Z", "assignerShortName": "dell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Secure Connect Gateway", "vendor": "Dell", "versions": [{"lessThan": "5.34.00.00 or later", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:secure_connect_gateway:*:*:*:*:-:*:*:*", "matchCriteriaId": "EA06F310-304F-4729-BBD3-8EB69179D32B", "versionEndExcluding": "5.34.00.00", "versionStartIncluding": "5.28.00.00", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:secure_connect_gateway:*:*:*:*:application:*:*:*", "matchCriteriaId": "4D7262CE-373D-40DB-826E-1AB4ADDAF250", "versionEndExcluding": "5.34.00.00", "versionStartIncluding": "5.28.00.00", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application version(s) 5.28.00.xx to 5.32.00.xx, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker within the management network could potentially exploit this vulnerability, leading to remote execution."}, {"lang": "es", "value": "Dell Secure Connect Gateway (SCG) 5.0 Appliance y Application en sus versiones 5.28.00.xx a 5.32.00.xx, contienen una vulnerabilidad de limitaci\u00f3n inadecuada de un nombre de ruta a un directorio restringido (\u2019salto de ruta\u2019). Un atacante con altos privilegios dentro de la red de gesti\u00f3n podr\u00eda potencialmente explotar esta vulnerabilidad, conduciendo a la ejecuci\u00f3n remota."}], "id": "CVE-2026-27101", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.4, "source": "security_alert@emc.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27101", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-01T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-04-01T08:16:05.270", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000438589/dsa-2026-020-security-update-for-dell-secure-connect-gateway-application-and-appliance-vulnerabilities"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.34.00.00 or later)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Secure Connect Gateway", "source": "cna", "vendor": "Dell"}, "product": "secure_connect_gateway", "vendor": "dell"}], "analysis": {"en": {"generated_at": "2026-04-02T23:02:01.380737+00:00", "value": {"mitigation_remediation": ["Apply the Dell Secure Connect Gateway security update recommended in the Dell advisory"], "summary": {"action": "Patch Now", "impact": "Remote Execution"}, "threat_synthesis": {"affected_systems": "It affects Dell Secure Connect Gateway 5.0 Appliance and Application within version range 5.28.00.xx to 5.32.00.xx. Users running any of those build numbers are potentially vulnerable.", "description_and_impact": "The vulnerability is an improper limitation of a pathname to a restricted directory, also known as Path Traversal. It allows a high\u2011privileged attacker who has access to the management network to upload or reference files outside the intended directory, potentially leading to the execution of arbitrary code on the Dell Secure Connect Gateway appliance or application.", "risk_and_exploitability": "The CVSS score of 4.7 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of exploitation. Because the attack requires privileged access to the internal management network, the vector is not publicly exposed. The vulnerability is currently not listed in CISA\u2019s KEV catalog, but once upstream patches are applied the risk is mitigated."}}}}, "created": "2026-04-02T07:49:47.808100+00:00", "title": "Secure Connect Gateway Path Traversal Allowing Remote Execution by Privileged Attacker", "updated": "2026-04-03T09:19:13.348988+00:00", "vendors": ["dell", "dell$PRODUCT$secure_connect_gateway"]}