CVE-2026-78490: Dell Secure Connect Gateway improper authentication attempt restriction

CVE-2026-78490 · Severity: high · CVSS 7.5 · Published 2026-09-09

Dell Secure Connect Gateway (SCG) is a remote access appliance and application used to manage secure connections to corporate networks. This vulnerability allows an unauthenticated attacker to bypass authentication protections by submitting excessive login attempts without restriction, potentially leading to account compromise or client-side request forgery attacks.

Technologies: Dell Secure Connect Gateway 5.0 Appliance, Dell Secure Connect Gateway 5.0 Application. Vendors: Dell.

Quick answers

Is CVE-2026-78490 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-78490 being exploited in the wild.
How severe is CVE-2026-78490?
High severity, with a CVSS score of 7.5, published 9 September 2026.
Which products and versions are affected?
Dell Secure Connect Gateway 5.0 Appliance prior to 5.36.00.16; Dell Secure Connect Gateway 5.0 Application prior to 5.36.00.00.
Is there a fix for CVE-2026-78490?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78490 attacked?
It is attacked over the network.
Am I affected by CVE-2026-78490?
Check whether you run Dell Secure Connect Gateway 5.0 Appliance or Dell Secure Connect Gateway 5.0 Application at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-78490 is an improper restriction of excessive authentication attempts vulnerability in Dell SCG 5.0 Appliance (versions prior to 5.36.00.16) and SCG 5.0 Application (versions prior to 5.36.00.00). The vulnerability allows an unauthenticated remote attacker to bypass rate-limiting or account lockout mechanisms that would normally protect against brute-force attacks. This lack of restriction on repeated authentication attempts enables attackers to perform credential stuffing or brute-force attacks with impunity. The advisory indicates the vulnerability can lead to client-side request forgery. Dell recommends upgrading to patched versions 5.36.00.16 (Appliance) or 5.36.00.00 (Application).

Affected products

  • Dell Secure Connect Gateway 5.0 Appliance prior to 5.36.00.16
  • Dell Secure Connect Gateway 5.0 Application prior to 5.36.00.00

Timeline

  • 2026-09-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.