Secure Connect Gateway EUVD-2026-88760

Exploitation requires the attacker to intercept network traffic to or from the Dell Secure Connect Gateway (SCG) Policy Manager - i.e. a man-in-the-middle or passive-sniffing position on the communication path (shared segment, compromised network device, or traffic redirection). No authentication is required (PR:N) and no user interaction is needed (UI:N), but the High attack complexity (AC:H) reflects that the attacker must first achieve that on-path interception position, which is the primary limiting factor. Applies to SCG Policy Manager versions prior to 5.34.00.16.

This is a moderate, defensively-weighted issue rather than a critical priority. The CVSS 3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) is driven entirely by confidentiality (C:H) with no integrity or availability impact, consistent with CWE-319 Cleartext Transmission. Although the vector is network (AV:N) and unauthenticated (PR:N), the High attack complexity (AC:H) is the key limiter: a cleartext-transmission flaw requires the attacker to occupy a privileged position on the network path (man-in-the-middle / traffic interception) rather than simply sending a packet to the service, which is why this is not a spray-and-pray exploit. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active exploitation or automatable mass exploitation - no public exploit identified at time of analysis. This is a genuine confidentiality-hygiene fix that matters in monitored/regulated environments, but it is not a high-urgency remote-code-execution-class threat. No conflicting signals were found: the CVSS vector, CWE, and description all align on unauthenticated remote information disclosure via interception.

An attacker positioned on the network path between a client and the Dell SCG Policy Manager (e.g. on a shared LAN segment, compromised switch, or via ARP/route manipulation) passively captures traffic and reads sensitive information transmitted in cleartext. Because the data is unencrypted, no credentials or crafted payload are needed once interception is achieved. No public POC is referenced, and the High attack complexity reflects the need to first gain that interception position.