EUVD-2026-85337
GHSA-r4xp-whfq-c88r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SCG Policy Manager over network
-
ExploitRequest source/client-side code
-
ExecutionExtract embedded sensitive information
-
ImpactReuse leaked secrets against environment
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Source code protection
|
| Exploitation Conditions | Requires network reachability to a Dell Secure Connect Gateway (SCG) Policy Manager instance running a version prior to 5.34.00.16; the attacker must be able to retrieve the source or client-delivered code that embeds sensitive information (CWE-540). No authentication, user interaction, or non-default configuration is indicated (AV:N/AC:L/PR:N/UI:N), so exploitation works against default deployments - but real-world risk is limited by the product's niche footprint (Dell support gateway, typically deployed in enterprise/appliance contexts rather than broadly internet-exposed) and by the fact that impact is confined to information disclosure with no integrity or availability effect. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5 HIGH) describes a cleanly network-reachable, low-complexity, unauthenticated confidentiality-only disclosure - internally consistent with CWE-540 (Inclusion of Sensitive Information in Source Code). No EPSS score, no CISA KEV listing, and no public POC are present in the supplied intelligence, so despite the 7.5 base score there is currently no positive evidence of real-world exploitation. This is a Dell-self-reported flaw (DSA-2026-385) with only a single vendor advisory reference and no independent corroboration. The realistic risk is moderate: the impact is bounded to information exposure (I:N/A:N - no tampering or outage), and the practical value depends entirely on WHAT sensitive data is embedded in the source/client-side code (e.g., hardcoded credentials, tokens, or internal paths), which the terse description does not specify. Treat this as a solid-but-not-emergency patch priority, weighted by the fact that SCG Policy Manager is a support-gateway component with limited deployment footprint rather than an internet-scale target. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the SCG Policy Manager over the network retrieves source or client-delivered code and extracts sensitive information embedded within it (per CWE-540), such as credentials, keys, or internal implementation details. No authentication, user interaction, or special complexity is required (AV:N/AC:L/PR:N/UI:N). No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Information exposure in Dell Secure Connect Gateway (SCG) Policy Manager affects all deployments running versions prior to 5.34.00.16, where sensitive data is embedded directly in shipped source or client-delivered code (CWE-540) and can be recovered and read by a remote party that obtains those artifacts. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 HIGH, describing a network-reachable, low-complexity, unauthenticated confidentiality-only flaw with no integrity or availability impact (PR:N in the vector confirms no authentication is required). No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so risk is driven by the value of whatever secrets are baked into the code and by the product's niche enterprise/appliance footprint rather than by observed attack activity.
RemediationAI
Apply the vendor-released patch: Dell Secure Connect Gateway (SCG) Policy Manager version 5.34.00.16 or later, as documented in Dell advisory DSA-2026-385 (Knowledge Base article 000503592 at https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities). Because the underlying defect is secrets baked into distributed code, upgrading corrects the code but does not retract anything already exposed, so rotate every credential, API key, token, or connection string that shipped with the Policy Manager build and treat it as compromised - expect the side effect of dependent integrations and support sessions requiring reconfiguration or re-enrollment after rotation. As compensating controls while the upgrade is scheduled or if it must be deferred: restrict network access to the SCG Policy Manager management interface and any artifact-download endpoints to a hardened administrative VLAN with firewall allow-lists rather than allowing broader internal or internet reachability (trade-off: administrators lose remote access and must use an approved jump host); avoid exposing the appliance beyond the enterprise perimeter, since the flaw carries PR:N and requires no user interaction; and monitor gateway and application logs for unexpected retrieval of static assets or source files that would indicate someone harvesting the embedded secrets (trade-off: added logging volume and tuning effort, with no ability to prevent the disclosure itself).
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-540, Inclusion of Sensitive Information in Source Code, a weakness in which confidential material - credentials, API keys, tokens, connection strings, or internal hostnames - is committed into source files or bundled client-side artifacts (HTML/JavaScript, configuration templates, compiled binaries, install bundles) that are distributed with the product. Because the sensitive material travels with the code, anyone who can obtain and inspect those artifacts effectively possesses the secret, and no exploitation primitive beyond retrieval and inspection is required. The CPE string cpe:2.3:a:dell:secure_connect_gateway_(scg)_policy_manager:*:*:*:*:*:*:*:* confirms the affected component is the Policy Manager module of Dell Secure Connect Gateway, an on-premises support-connectivity appliance typically deployed inside enterprise networks to broker telemetry and remote-support sessions with Dell; it is therefore usually reachable on management networks rather than openly internet-facing. The network vector (AV:N) in the independent assessment is consistent with the code or client-delivered artifacts being retrievable over the network without credentials, and the single-scope, confidentiality-only scoring (C:H/I:N/A:N) matches a pure secret-disclosure impact - if the leaked material includes credentials to other Dell or downstream systems, secondary risk exists but is not measured by this vector.
Know when Secure Connect Gateway Scg Policy Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable source-code disclosure (PR:N/AV:N/AC:L) with confidentiality-only impact and no integrity or availability effect (I:N/A:N).
Primary rating from Vendor (dell).
CVSS VectorVendor: dell
Lifecycle Timeline
2DescriptionCVE.org
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
Executive ViewAI
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an information exposure vulnerability (CVE-2026-73591) that allows unauthenticated remote attackers to recover sensitive data embedded in shipped code. Organizations running affected versions face potential exposure of credentials or secrets that could be used for further intrusion, though no public exploit identified at time of analysis. Leadership should prioritize mitigating this high-severity confidentiality risk to prevent downstream compromise.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting network access to affected SCG Policy Manager instances, rotating any potentially exposed secrets, and monitoring for anomalous access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Weak authentication throttling in Dell Secure Connect Gateway (SCG) Policy Manager allows unauthenticated remote attacke
Privilege escalation, filesystem access, and remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager a
Authorization bypass in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged user tamp
Improper X.509 certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets an unauthenticated attack
Privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager allows an authenticated, network-reachable low-
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager lets an attacker who already holds a valid lo
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets a man-in-the-middle who alr
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager allows a remote attacker who already hol
Protection mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager (versions below the vendor-fixed release
Cross-site request forgery in Dell Secure Connect Gateway (SCG) Policy Manager prior to the vendor-fixed build allows a
Local privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets a low-p
Unauthenticated remote attackers can reach a critical function in Dell Secure Connect Gateway (SCG) Policy Manager witho
Exploit-DB