SCG Policy Manager CVE-2026-73586

Requires adjacent-network access to the Dell SCG Policy Manager (AV:A - not internet-remote), pre-existing low-privileged access (PR:L), and victim user interaction (UI:R). The core condition is presence of a session that the Policy Manager fails to expire properly (CWE-613), letting the attacker reuse a stale/valid-too-long session token to escalate privileges and gain unauthorized access. High attack complexity (AC:H) further limits reliability. Affects Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 (per Dell advisory; EUVD cites <5.36.00.16 - verify).

This is a moderate-severity issue (vendor CVSS 6.4) that presents low real-world urgency. The CVSS vector CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L is heavily gated: exploitation requires adjacent network access (AV:A, not remote-internet), high attack complexity (AC:H), pre-existing low privileges (PR:L), and victim user interaction (UI:R). CWE-613 (Insufficient Session Expiration) means an attacker leverages a session token/ID that remains valid longer than it should - enabling session reuse rather than a clean credential-less break-in. There is no EPSS score, no CISA KEV listing, and no public POC identified, so all three exploitation-likelihood signals are absent or negative. The high C:H/I:H impact rating drives the score up, but the multiple stacked prerequisites (adjacent + low-priv + user interaction + high complexity) make opportunistic or widespread exploitation unlikely. Note a data conflict to verify: the description and DSA-2026-385 cite the fix as 5.34.00.16, while the EUVD affected-version field states '<5.36.00.16 or later' - the fixed version should be confirmed against Dell's advisory. Overall this is a defense-in-depth session-management fix for a low-footprint enterprise gateway, not an emergency patch.

A low-privileged attacker on the same adjacent network segment obtains or reuses a session token that the SCG Policy Manager failed to expire (e.g., a stale session left valid after logout or timeout), and combines it with tricking a legitimate user into an action (UI:R) to ride that session. Successfully replaying the non-expired session lets the attacker escalate privileges, bypass a protection mechanism, and gain unauthorized access to the management interface. No public exploit code has been identified at time of analysis, and the high attack complexity limits reliability.