CVE-2026-79735

Hard‑Coded Cryptographic Key in Dell Secure Connect Gateway 5.0 Enables Potential Information Disclosure

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-79942

Unauthorized Local Access via Unnecessary Privileges in Dell Secure Connect Gateway 5.0

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-79944

Dell Secure Connect Gateway 5.0 Local Privilege Escalation Vulnerability

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-79692

External Control of File Name or Path Enables Remote Filesystem Access in Dell Secure Connect Gateway 5.0

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Path vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for attacker.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-84967

Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal

A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized-user who persuades a developer to accept a user-supplied connection target, and then to open the extension's shell feature, can place characters of the unauthorized-user’s choosing into that command line. No privileges on the developer's machine are required, but several user actions are. The confirmation the developer sees does not display the supplied text.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Mongodb Mongodb For Vs Code

CVE-2026-79637

Improper Certificate Validation Enables Remote Unauthorized Access in Dell Secure Connect Gateway 5.0

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-78490

Improper Restriction of Excessive Authentication Attempts in Dell Secure Connect Gateway 5.0

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to client-side request forgery.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-78489

Improper Certificate Validation in Dell Secure Connect Gateway 5.0

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-78485

Path Traversal Vulnerability in Dell Secure Connect Gateway 5.0 Allowing Unauthorized Remote Access

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-80239

Exposure of Sensitive System Information from Uncleared Debug Information

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to information exposure.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-79727

Exposure of Sensitive System Information Due to Uncleared Debug Information in Dell Secure Connect Gateway 5.0

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-79641

OS Command Injection in Dell Secure Connect Gateway 5.0 Allows Privilege Escalation

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-80122

Improper Certificate Validation in Dell Secure Connect Gateway Allows Unauthorized Remote Access

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-9854

Privilege Escalation via RBAC Bypass in Hitachi Energy MicroSCADA SYS600

A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Hitachienergy

Products

Microscada Sys600 Microscada X Sys600

CVE-2026-79974

Improper Authentication in Dell Secure Connect Gateway 5.0 Enabling Unauthorized Remote Access

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-79973

Unsynchronized Access to Shared Data Leading to Denial of Service in Dell Secure Connect Gateway

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Unsynchronized Access to Shared Data in a Multithreaded Context vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-79640

SQL Injection in Dell Secure Connect Gateway 5.0 Leading to Unauthorized Access

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-78494

Improper Certificate Validation in Dell Secure Connect Gateway 5.0 Allowing Remote Unauthorized Access

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Dell

Products

Secure Connect Gateway

CVE-2026-9853

OS‑Level Access Allows Unauthorized Modification of SYS600 Objects

A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify application objects.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Hitachienergy

Products

Microscada Sys600 Microscada X Sys600

CVE-2026-9852

CSV Injection in Hitachi Energy MicroSCADA SYS600 Enabling Data Manipulation and Potential Code Execution

A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Hitachienergy

Products

Microscada Sys600 Microscada X Sys600