CVE-2026-80238
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. This vulnerability is considered critical because a low-privileged operator with SSH access to the SCG host can gain root-level access to the host without requiring a password by leveraging the exposed Docker socket. Additionally, an attacker who compromises a service running within the orchestrator container can access the same socket and escape the container boundary to obtain host-level control. Dell recommends that customers upgrade at the earliest opportunity.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.3
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- EPSS probability
- 0.15%
- CWE
- CWE-250
- Published
- 2026-09-07
- Last modified
- 2026-09-08
Affected products
- Dell Secure Connect Gateway 5.0 - Application
- Dell Secure Connect Gateway 5.0 - Appliance
Weakness type
Related vulnerabilities
- CVE-2026-79942 — Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to...
- CVE-2026-87506 — Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who...
- CVE-2026-69464 — Microsoft Office SharePoint Elevation of Privilege Vulnerability
- CVE-2026-69409 — Microsoft Office SharePoint Information Disclosure Vulnerability
- CVE-2026-83534 — PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()
- CVE-2026-72654 — Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure
- CVE-2026-76018 — Privilege elevation in Import in Google Chrome prior to 151.0.7922.173 allowed a remote attacker...
- CVE-2026-70496 — Search-v2-operator: search-v2-operator: operator clusterrole is cluster-admin equivalent via impersonate, rbac write, csr approve, and manifestwork