CVE-2026-80129 is a medium severity (CVSS 6.5) path traversal in Dell Secure Connect Gateway 5.0. Appliance versions before 5.36.00.16 and Application versions before 5.36.00.00 are affected. Dell says it could lead to remote execution. Update to those builds or later, per advisory DSA-2026-382.
What's affected
- Product: Dell Secure Connect Gateway (SCG) 5.0.
- Affected: Dell SCG 5.0 Appliance versions prior to 5.36.00.16, and Dell SCG 5.0 Application versions prior to 5.36.00.00.
- Fixed: Appliance 5.36.00.16 and Application 5.36.00.00, or later. Dell's page would not load for me, so confirm the details in DSA-2026-382.
- Weakness: CWE-22, path traversal.
- CVSS 6.5 (medium), vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N. Dell lists the outcome as remote execution. Not listed in CISA KEV.
How to check if you're exposed
Find your Secure Connect Gateway deployments and read the version in the admin interface. Appliance builds need 5.36.00.16 or later, and the Application build needs 5.36.00.00 or later.
Then check who can reach the service. The record says an unauthenticated attacker with remote access could use this flaw, so network reach is the main factor. Find firewall rules or proxies that expose it beyond the networks that need it.
What to do now
- Find every Dell SCG appliance and application install and its version.
- Update to Appliance 5.36.00.16 or Application 5.36.00.00, or later, per Dell advisory DSA-2026-382.
- Restrict network access to the gateway to the networks that need it.
- Read DSA-2026-382 for the other CVEs fixed in the same update, since one upgrade covers them.
Why it matters
Path traversal means a crafted path lets a request reach files outside the folder the code meant to expose. Dell says an unauthenticated attacker with remote access could use this, and lists remote execution as the outcome.
Dell fixed two path traversal issues in this update, CVE-2026-80129 and CVE-2026-80131. Treat them as one patch job.
Quick check
Is there a second path traversal in this update?
Yes. CVE-2026-80131 is also CWE-22 in the same product and update.
Sources
Last reviewed: 19 October 2026.
