CVE-2026-78482 is a medium severity (CVSS 5.5) flaw in Dell SCG 5.0 Appliance and Application. According to the record, exploitation is local and needs a low privilege account. Dell fixed it in 5.36.00.16 for the appliance and 5.36.00.00 for the application, so check your version and update. Details are in Dell's advisory.
What's affected
Dell SCG 5.0 Appliance versions before 5.36.00.16, and Dell SCG 5.0 Application versions before 5.36.00.00. The fixes are 5.36.00.16 for the appliance and 5.36.00.00 for the application. Dell's advisory is DSA-2026-382, a security update for the Secure Connect Gateway virtual edition covering multiple vulnerabilities.
We could not retrieve Dell's advisory (the site returned an access denied response to our request), so the versions here come from the NVD record only. Read the advisory itself to confirm affected editions and any extra steps before you plan the change. The record does not mark the issue as exploited, and the KEV flag is false.
Three records in this set (CVE-2026-78482, CVE-2026-78484 and CVE-2026-78493) carry the same text and the same references. Dell's advisory is the place to see how they differ.
How to check if you're exposed
Find the version of each SCG deployment and compare it with the fixed version.
In the SCG appliance console or web interface, open the About or version view. For the application edition, check the installed version on the host.
Dell shows these fields in different places by release, so use the product's own documentation if the labels differ. Record each instance, its version and who can reach it, because the record says the attacker needs a low privilege account and local or network access as listed.
What to do now
- Update to the fixed version listed in DSA-2026-382, following Dell's instructions for your edition.
- List every SCG instance, including test and lab copies, so none stays behind on the old version.
- Limit who can log in or reach the management interface to the staff who need it, and review the accounts that exist today.
- After the update, confirm the version number and check Dell's advisory for any follow-up configuration steps.
Why it matters
The record classes this as CWE-89, a weakness the record labels as SQL injection, although Dell's description reads OS command injection. Either way, input is mixed with an interpreter's syntax without being kept separate as data.
The record rates attack complexity low, and says the attacker needs a low privilege account. The listed outcome is: command execution. Treat it as a command injection issue when you assess risk, and review local access to the host.
The SCG product is a gateway that connects Dell systems to support services, so it often sits close to infrastructure and credentials. Dell's advisory bundles several issues, and applying the update fixes them together, which is the main reason to treat this as one project and not several.
Quick check
Is there a workaround?
We could not read Dell's advisory, so check it. The record gives the fixed version as the remedy.
Is this exploited?
The record's KEV flag is false and we found no report of exploitation.
Sources
Last reviewed: 18 October 2026.
