SCG Policy Manager EUVD-2026-88736

Exploitation requires the attacker to occupy an adjacent-network (AV:A) man-in-the-middle position on a path the SCG Policy Manager uses for TLS communication, then abuse the improper certificate validation to substitute or forge a certificate the client fails to reject. No authentication (PR:N) or user interaction (UI:N) is needed once that position is held. The key limiting factors are the adjacency requirement (not remotely exploitable across the internet) and the need to actively intercept/relay traffic to achieve the MITM - a passive attacker on an unrelated network cannot trigger it. Affected deployments are versions prior to 5.34.00.16 and prior to 5.36; patched releases remove the exposure.

Signals are consistent and point to a genuine but position-gated threat rather than a mass-exploitation emergency. The CVSS 3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects an unauthenticated, low-complexity attack with total CIA impact, but the Adjacent (AV:A) vector - not Network - is the critical limiter: an attacker must already hold an adjacent-network/man-in-the-middle position to abuse the improper certificate validation (CWE-295). EPSS is very low at 0.08% (0th percentile), and CISA SSVC records Exploitation: none and Automatable: no, which align with the absence of any KEV listing or public POC; the only counterweight is SSVC Technical Impact: total, matching the high CVSS impact metrics. There is no conflict among the sources: all exploitation-likelihood indicators (EPSS, SSVC, KEV, POC) are low/negative while impact indicators are high. Net assessment: a legitimately high-impact flaw that is not a drop-everything priority for internet-exposed mass exploitation, but should be patched promptly in environments where an attacker could plausibly reach the same L2/adjacent segment as the SCG Policy Manager (e.g., shared management networks).

An attacker positioned on the same adjacent network segment as the Dell SCG Policy Manager intercepts TLS traffic and, because certificates are not properly validated, presents a forged or substituted certificate to perform a man-in-the-middle attack. This lets them read sensitive data in transit, tamper with exchanged messages, and bypass the protection mechanism that certificate validation was meant to enforce. No public exploit identified at time of analysis, and no user interaction or authentication is required once the adjacent position is held.