Secure Connect Gateway CVE-2026-78340

Exploitation requires the attacker to already have LOCAL access to the host running Dell Secure Connect Gateway (SCG) Policy Manager AND to already hold HIGH privileges on the application (per PR:H), plus user interaction (UI:R) and non-trivial conditions to succeed (AC:H). The core trigger is supplying attacker-controlled pathname input containing directory-traversal sequences to a Policy Manager feature that resolves file paths without properly restricting them to the intended directory (CWE-22). Limiting factors that reduce realistic risk: no remote or network vector (local only), no unauthenticated path (privileged account required), mandatory user interaction, and high attack complexity. Affected deployments are Dell SCG Policy Manager versions prior to the vendor's fixed release (5.34.00.16 per the description / 5.36.00.16 per EUVD - confirm with Dell).

This is a moderate-severity, low-urgency issue despite the HIGH confidentiality/integrity/availability impacts. The CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:R, base 6.3) stacks four independent limiting factors: the attacker must already have local access, already hold high privileges, overcome high attack complexity, and secure user interaction. In practice an attacker meeting all of those conditions already has substantial control of the host, so the marginal risk added by this path-traversal flaw is low. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of real-world or imminent exploitation - consistent with the operator/privilege-dependent nature of the bug. There are no conflicting signals between the vector and the description: the description's 'high privileged attacker with local access' aligns cleanly with PR:H and AV:L. The one data discrepancy is on fixed version, not risk: the description cites 'prior to 5.34.00.16' while the EUVD record cites '<5.36.00.16' - this should be verified against the Dell advisory (DSA-2026-385) before remediation. Overall: a genuine code-execution flaw worth patching in Dell SCG environments, but not a drop-everything priority.

An administrator-level user with local access to the Dell Secure Connect Gateway Policy Manager supplies a crafted pathname containing directory-traversal sequences to a feature that handles file paths, and induces a privileged action (user interaction required) that writes to or reads from a location outside the intended restricted directory. This lets the attacker access arbitrary filesystem contents and ultimately achieve code execution on the host. No public exploit code was identified at the time of analysis.