Secure Connect Gateway CVE-2026-78022

Exploitation requires network reachability to the SCG Policy Manager and valid low-privileged credentials on it (CVSS PR:L), so this is NOT a pre-auth/unauthenticated flaw - an attacker must first hold a low-privilege account or session. The core condition is the 'failing open' behavior of CWE-636: a protection/authorization check that, on error or unexpected input, grants rather than denies access, letting the low-privileged actor bypass intended controls. No user interaction is needed (UI:N) and complexity is low (AC:L). Limiting factors for defenders: the requirement for an existing low-privileged account, the need for network access to the management interface (restricting exposure if the interface is not internet-facing or is network-segmented), and that affected deployments are those running SCG Policy Manager below the fixed version (confirm 5.34.00.16 vs 5.36.00.16 with Dell).

Signals are moderately conflicting and point to an elevated-but-not-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 HIGH) describes a network-reachable, low-complexity bypass requiring only low privileges, yielding high confidentiality and integrity impact - consistent with a fail-open protection-mechanism bypass (CWE-636) that lets an already-authenticated low-privileged user escape authorization controls. However, exploitation-probability signals are weak and mutually reinforcing: EPSS is only 0.20% (9th percentile), there is no CISA KEV listing, no public POC identified, and CISA SSVC scores Exploitation=none and Automatable=no (while Technical Impact=total, matching the C:H/I:H rating). So this is a genuinely impactful flaw but not currently under active or automatable exploitation - a 'high CVSS, low current real-world exploitation' profile that warrants prompt patching on exposed SCG Policy Manager instances rather than emergency response. One data conflict must be verified: the NVD/CVE description states the fix is 'versions prior to 5.34.00.16' while the ENISA EUVD lists the affected range as '<5.36.00.16' - the exact fixed version should be confirmed against the Dell advisory (DSA-2026-385) before remediation.

A low-privileged user with remote (network) access to the Dell Secure Connect Gateway Policy Manager interface triggers the condition under which a protection/authorization check fails open rather than denying access. Because the check defaults to 'allow' on error, the attacker bypasses the intended protection mechanism and gains access to protected data and functions normally restricted to higher-privileged roles. No public exploit code or active exploitation has been identified, and the low AC means no special timing or complex preconditions are needed once the actor has valid low-level credentials.