EUVD-2026-88747
GHSA-57q3-hg4w-7ccc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost malicious page targeting Policy Manager
-
DeliveryLure authenticated admin to click link
-
ExploitBrowser submits forged cross-site request
-
ExecutionServer processes request without origin validation
-
ImpactInformation disclosure or tampering / protection bypass
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V3 - Web Frontend Security Anti-CSRF tokens, SameSite cookies
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an already-authenticated Dell SCG Policy Manager user (typically an administrator) to be tricked into visiting attacker-controlled content or clicking a crafted link while their session is active - this user interaction (UI:R) is the primary limiting factor and cannot be skipped for a CSRF flaw. The attacker themselves needs no credentials (PR:N) and only network reachability to the victim's browser, but the Policy Manager instance must be reachable by that browser and the targeted administrator must have an active/valid session. There is no special non-default product configuration named in the advisory; the weakness is the absence of anti-CSRF protections on state-changing requests. Affected: Secure Connect Gateway (SCG) Policy Manager prior to the vendor-fixed build (5.34.00.16 per description / 5.36.00.16 per EUVD - confirm with Dell). |
| Impact | Signals are consistent and point to a genuine-but-not-urgent issue. CVSS 3.1 is 8.1 (High) with AV:N/AC:L/PR:N/UI:R - network-reachable and unauthenticated, but critically gated on UI:R, meaning an authenticated Policy Manager operator must be lured into triggering the forged request; this is inherent to the CWE-352 CSRF class. EPSS is very low (0.12%, 1st percentile) and CISA SSVC lists Exploitation: none, which aligns with the absence of any KEV listing or public POC. SSVC does flag Automatable: yes and Technical Impact: partial, but 'automatable' for a CSRF that still needs victim interaction refers to request delivery, not autonomous self-propagation. The C:H/I:H in the vector (information disclosure and tampering) is the main severity driver, yet it is only realizable if a privileged user is socially engineered. Net: a real, patch-worthy vulnerability but a prioritize-after-internet-facing-unauthenticated-RCE issue - not an emergency. Note a data conflict: the NVD/Dell description says versions prior to 5.34.00.16 while the EUVD record cites <5.36.00.16 or later - the exact fixed version should be confirmed against Dell DSA-2026-385 before remediation. |
| Exploit ScenarioDerived | An attacker crafts a malicious web page or email containing a hidden request targeting the Dell SCG Policy Manager interface and lures an authenticated administrator into opening it (UI:R). Because the application does not validate request origin (CWE-352), the victim's browser silently submits the forged state-changing request, allowing information disclosure, data tampering, or protection-mechanism bypass. No public exploit identified at time of analysis, so an attacker would need to develop the forged request from the advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 15, 2026
Cross-site request forgery in Dell Secure Connect Gateway (SCG) Policy Manager prior to the vendor-fixed build allows a remote, unauthenticated attacker to ride an already-authenticated administrator's browser session and issue state-changing requests, resulting in information disclosure, information tampering, protection-mechanism bypass, and potential use of the product as a launch point for phishing. Per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N), the attacker needs no credentials of their own but must trick a logged-in Policy Manager user - typically an administrator - into visiting attacker-controlled content or clicking a crafted link, so that user interaction (UI:R) is the sole barrier and cannot be skipped; the targeted appliance must also be reachable from the victim's browser and a valid session must be active. No public exploit code has been identified at time of analysis, EPSS is only 0.12% (1st percentile), and CISA's SSVC framework rates exploitation as none with automatable:yes and partial technical impact, so this is a genuine but not urgent issue for which a vendor patch is available.
Earlier versions of this analysis (1)
Cross-site request forgery in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 enables a remote attacker to induce a victim with an active authenticated session into loading crafted web content, causing unauthorized actions that lead to low-level information disclosure, information tampering, phishing facilitation, and protection-mechanism bypass. Although the vendor CVSS vector lists PR:N/UI:N, our assessment confirms exploitation requires a logged-in operator session and victim interaction (UI:R), limiting practical impact. This moderate-severity flaw (CVSS 6.5) has no public exploit identified at time of analysis and is not confirmed as actively exploited (CISA KEV).
RemediationAI
Patch available per vendor advisory: upgrade Dell Secure Connect Gateway (SCG) Policy Manager to the fixed build published in Dell DSA-2026-385 (https://www.dell.com/support/kbdoc/en-ca/000503592/dsa-2026-385-security-update-for-dell-secure-connect-gateway-policy-manager-multiple-vulnerabilities); because the CVE description cites 5.34.00.16 and the ENISA EUVD entry cites 5.36.00.16 as the remediation boundary, verify the exact required version with Dell support rather than assuming either number, and note the advisory covers multiple vulnerabilities so the full update should be applied, not cherry-picked. Where immediate upgrading is not possible, compensating controls are available but each has trade-offs: restrict network reachability to the Policy Manager administrative interface to trusted management VLANs, VPN-only access, or an allowlist of administrator source IPs, accepting that this blocks legitimate remote and mobile administrators; enforce short session idle timeouts and require administrators to log out after use and to avoid browsing untrusted sites in the same browser profile, which reduces the window of exposure but depends on user discipline and cannot be centrally verified; and where a reverse proxy or WAF is already in front of the appliance, inject or enforce CSRF token validation plus Origin/Referer header checks and a Content-Security-Policy on the Policy Manager routes, accepting false positives from legitimate clients that omit the Origin header and the operational overhead of proxy rule maintenance. The Dell advisory should be monitored for any revision to the fixed build number before remediation is scheduled as complete.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-352 (Cross-Site Request Forgery): SCG Policy Manager does not enforce sufficient anti-CSRF protections on state-changing requests, so a browser that already holds a valid authenticated session cookie will automatically attach that credential to requests forged by a third-party page. Because CSRF relies on ambient browser authority rather than stolen credentials, the CVSS PR:N (unauthenticated attacker) coexists with the requirement that a legitimate, privileged user be logged in - the attacker never authenticates to the product, the victim's browser does it for them. The scope-unchanged (S:U) and availability-none (A:N) components indicate the flaw stays within the Policy Manager's security authority and does not directly cause denial of service, while the high confidentiality and integrity components reflect that forged requests can read or alter policy, configuration, and possibly credential-related data. The affected CPE, cpe:2.3:a:dell:secure_connect_gateway_(scg)_policy_manager:*:*:*:*:*:*:*:*, is fully version-wildcarded, so the vulnerable code base spans all builds in this product line prior to the fixed release. The absence of an anti-CSRF token check, combined with permissive cookie attribute handling (e.g., missing or ineffective SameSite protection) and unrestricted cross-origin request acceptance, is the practical attack surface; Dell's advisory bundles this issue with multiple other vulnerabilities in the same update.
Know when Secure Connect Gateway Scg Policy Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CSRF reachable over the network by an unauthenticated attacker (PR:N) but requires a privileged victim to act (UI:R); advisory cites information disclosure and tampering (C:H/I:H) with no availability impact.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Launch of phishing attacks, and Protection mechanism bypass.
Executive ViewAI
A cross-site request forgery flaw in Dell Secure Connect Gateway (SCG) Policy Manager (CVE-2026-73597, CVSS 8.1) allows an attacker who holds no credentials to ride a logged-in administrator's browser session and issue privileged, state-changing requests against the appliance, putting configuration data and protection mechanisms at risk and potentially turning the gateway into a phishing launch point. Because SCG is a management and support conduit into the broader Dell-managed estate, compromise of this component can undermine visibility and trust across connected infrastructure and support workflows. Exploitation requires an administrator to visit attacker-controlled content while an active session exists; no public exploit identified at time of analysis, and the vendor has made a fixed build available, so leadership should treat this as a manageable, patch-driven exposure rather than an active incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Weak authentication throttling in Dell Secure Connect Gateway (SCG) Policy Manager allows unauthenticated remote attacke
Privilege escalation, filesystem access, and remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager a
Authorization bypass in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged user tamp
Improper X.509 certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets an unauthenticated attack
Privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager allows an authenticated, network-reachable low-
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager lets an attacker who already holds a valid lo
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets a man-in-the-middle who alr
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager allows a remote attacker who already hol
Protection mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager (versions below the vendor-fixed release
Local privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets a low-p
Unauthenticated remote attackers can reach a critical function in Dell Secure Connect Gateway (SCG) Policy Manager witho
Information exposure in Dell Secure Connect Gateway (SCG) Policy Manager affects all deployments running versions prior
Exploit-DB