Secure Connect Gateway EUVD-2026-85335

Requires local access to a Dell Secure Connect Gateway (SCG) Policy Manager host running a version prior to 5.34.00.16, plus an existing low-privileged account (PR:L) on that system - this is not remotely exploitable and needs no user interaction. Exploitation further depends on the attacker being able to reach the location where passwords are stored using the weak/reversible encoding and successfully reversing it, which the vendor reflects as high attack complexity (AC:H). Limiting factors: local-only vector, prior authenticated foothold required, and non-trivial effort to recover and abuse the encoded credentials.

This is a moderate, defense-in-depth issue rather than a front-line priority. The Dell-assigned CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N, 6.3) is internally consistent with the description: local access (AV:L), an already-authenticated low-privileged account (PR:L), and high attack complexity (AC:H) because the attacker must reach the weakly-encoded credential material and reverse it. Despite HIGH confidentiality and integrity impact, the local-only vector and required prior foothold sharply limit real-world urgency - this is not remotely exploitable. There is no EPSS score, no CISA KEV listing, and no public POC, and no SSVC decision point was provided, so all exploitation-likelihood signals are absent rather than elevated. Net: a real weakness worth patching in maintenance windows, but not an emergency; it functions as a privilege-escalation/credential-recovery stepping stone for an attacker who already has a local low-privileged account, not an initial-access vulnerability. Note the version data is inconsistent across the input (see confidence_notes).

A low-privileged local user on a Dell SCG Policy Manager host (e.g., an operator or a compromised service account) locates stored credentials that are protected only by a weak, reversible encoding rather than strong cryptographic hashing. They decode the stored value to recover the plaintext password, then reuse it to access data, tamper with configuration, or bypass a protection mechanism. No public exploit code is identified at time of analysis, and the high attack complexity means success depends on the attacker's ability to reach and interpret the encoded credential store.