Secure Connect Gateway EUVD-2026-85330

Requires network reachability to the Dell Secure Connect Gateway (SCG) Policy Manager web interface on a version prior to 5.34.00.16; no authentication or user interaction is required (PR:N/UI:N). Exploitation is LIMITED by AC:H - the attacker must find the specific non-canonical URL path representation that the Policy Manager's authorization logic normalizes differently from its request routing, which is not a generic single-request attack against defaults. Impact is confined to unauthorized access to protected functions with limited integrity effect (I:L); no confidentiality or availability impact is claimed by the vendor.

This is a low-priority issue despite being unauthenticated and network-reachable. Dell's own CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N = 3.7) already caps real-world impact: the only consequence is limited unauthorized access mapped to I:L, with no confidentiality (C:N) or availability (A:N) impact, and AC:H reflects that the attacker must discover and craft a specific non-canonical/encoded URL variant that the Policy Manager normalizes differently for authorization versus routing. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided intelligence, so there is no signal of active or imminent exploitation. The signals are internally consistent (network CWE-647 path-confusion authz bypass matches AV:N/PR:N/AC:H), so no attack-vector conflict needs vendor verification. Note the description says the flaw 'leads to Unauthorized access' yet Dell scored only integrity (I:L) with C:N - if unauthorized access in practice exposes data, real confidentiality impact could be understated; verify affected endpoint behavior with Dell. Net: a genuine defect worth patching in the normal cycle, not an emergency.

A remote unauthenticated attacker who can reach the SCG Policy Manager web interface sends requests using non-canonical URL path forms (e.g., encoded separators, path traversal segments, or trailing-character tricks) that the authorization layer evaluates differently from the request router, letting a request slip past an access-control check to reach a protected function. Because CVSS marks AC:H, the attacker must first identify the exact path-normalization discrepancy through trial and error. No public proof-of-concept exploit is identified at time of analysis.