SCG Policy Manager CVE-2026-78015

Exploitation requires the attacker to control or influence a data source that Dell SCG Policy Manager treats as trusted (CWE-348, Use of Less Trusted Source), then deliver falsified input over the network. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the high attack complexity (AC:H) means the attacker must achieve a specific precondition - such as a favorable network position to spoof or inject responses, or winning a timing/trust-state race - that is not reliably reproducible. Impact is limited to low-level information tampering (I:L); there is no confidentiality or availability effect, which materially limits the practical damage. Affected deployments are those running Policy Manager versions prior to 5.34.00.16.

This is a genuinely low-priority issue despite being a network-exploitable, unauthenticated vulnerability. The CVSS 3.1 base score of 3.7 (LOW) is driven by three limiting factors: high attack complexity (AC:H), a scope-unchanged impact, and the fact that the only impact is low integrity (I:L) - no confidentiality (C:N) and no availability (A:N) effect. CWE-348 (Use of a Less Trusted Source) combined with I:L indicates an attacker can tamper with or influence data by supplying input from an untrusted origin, not steal data or crash the service. All the signals point in the same low-risk direction and do not conflict: no EPSS score was provided, the CVE is NOT on the CISA KEV list, and no public proof-of-concept is referenced in the single Dell advisory. The AC:H metric means successful exploitation depends on conditions outside the attacker's control (e.g., winning a race, specific source/trust state, or crafted responses), which substantially reduces real-world exploitability. Note one labeling discrepancy worth verifying: the input Tags list 'Information Disclosure,' but the CVSS vector (C:N, I:L) and CWE-348 describe an INTEGRITY/tampering impact, not disclosure - the tag appears mislabeled.

A remote, unauthenticated attacker positioned to influence a data source that the SCG Policy Manager trusts (e.g., spoofed or manipulated network responses) feeds falsified input, causing the Policy Manager to accept tampered information. Because of high attack complexity, the attacker must satisfy specific conditions (such as timing or network positioning) for the tampering to take effect, and no public exploit code is identified at time of analysis.