SCG Policy Manager CVE-2026-73595

The flaw is a missing integrity/signature check (CWE-494) on code the SCG Policy Manager downloads, so realistic exploitation requires the attacker to control or tamper with the content the Policy Manager retrieves - typically a man-in-the-middle position on the appliance's network path or a spoofed/compromised download source - rather than a single direct request to the product. No authentication is required (PR:N) and no user interaction (UI:N). Limiting factors: the appliance must be reachable and actively fetching code, and SSVC rates the issue as not automatable, indicating exploitation is not point-and-click; this aligns with the very low EPSS and non-KEV status.

Signals conflict sharply, so this is likely a lower real-world priority than its 9.8 CVSS implies. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) and SSVC Technical Impact of 'total' describe a maximally severe outcome, and PR:N confirms the flaw is unauthenticated. However, the SSVC decision framework reports Exploitation 'none' and Automatable 'no', the EPSS score is only 0.11% (1st percentile), the CVE is NOT in CISA KEV, and no POC is referenced - every exploitation-likelihood signal is low despite the high impact signal. Additionally, CWE-494 (Download of Code Without Integrity Check) typically requires the attacker to substitute or tamper with code in transit, which in practice often needs a man-in-the-middle or control of the update/download source rather than a simple direct request; the vendor's AC:L may understate this. Bottom line: patch-worthy given total impact and unauthenticated vector, but current evidence points to no active or imminent mass exploitation - treat as high-severity-but-low-current-likelihood and prioritize patching behind anything KEV-listed.

An attacker positioned to influence code or content retrieved by the SCG Policy Manager (e.g., via a man-in-the-middle position or a compromised/spoofed download source) supplies malicious code that the Policy Manager fetches without verifying its integrity or signature. The product then executes or trusts the attacker-supplied code, yielding remote code execution, information disclosure, and tampering. No POC or active exploitation is referenced at time of analysis.