CVE-2026-80131 is a high severity (CVSS 7.4) path traversal in Dell Secure Connect Gateway 5.0. Appliance versions before 5.36.00.16 and Application versions before 5.36.00.00 are affected. Dell says it could lead to remote execution. Update to those builds or later, per advisory DSA-2026-382.
What's affected
- Product: Dell Secure Connect Gateway (SCG) 5.0.
- Affected: Dell SCG 5.0 Appliance versions prior to 5.36.00.16, and Dell SCG 5.0 Application versions prior to 5.36.00.00.
- Fixed: Appliance 5.36.00.16 and Application 5.36.00.00, or later. Dell's page would not load for me, so confirm the details in DSA-2026-382.
- Weakness: CWE-22, path traversal.
- CVSS 7.4 (high), vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. Dell lists the outcome as remote execution. Not listed in CISA KEV.
How to check if you're exposed
Find your Secure Connect Gateway deployments and read the version in the admin interface. Appliance builds need 5.36.00.16 or later, and the Application build needs 5.36.00.00 or later.
Then check who can reach the service. The record says an unauthenticated attacker with remote access could use this flaw, so network reach is the main factor. Find firewall rules or proxies that expose it beyond the networks that need it.
Write down what you find, with the owner, version and network exposure of each instance. After you patch, check again and record the fixed version, so the next advisory starts from a current inventory. You can also paste a dependency manifest into the free scan at gold.safeguard.sh/scan for any packaged components that sit alongside this product.
What to do now
- Find every Dell SCG appliance and application install and its version.
- Update to Appliance 5.36.00.16 or Application 5.36.00.00, or later, per Dell advisory DSA-2026-382.
- Restrict network access to the gateway to the networks that need it.
- Read DSA-2026-382 for the other CVEs fixed in the same update, since one upgrade covers them.
Why it matters
This is the higher scored of the two path traversal issues in the update. The vector shows high confidentiality and integrity impact, with high attack complexity, and no login needed.
Complexity is not comfort. Gateways are reachable by design, so do the update and narrow network access in the same change.
Quick check
Which of the two path traversals is worse?
NVD scores CVE-2026-80131 at 7.4 and CVE-2026-80129 at 6.5. Both are fixed together.
Sources
Last reviewed: 19 October 2026.
