Secure Connect Gateway EUVD-2026-95561

Exploitation requires the attacker to already hold a valid low-privileged authenticated account on the Dell Secure Connect Gateway (SCG) Policy Manager and have network/remote access to it (PR:L, AV:N) - it is NOT remote-unauthenticated. The flaw is a missing authorization check (CWE-862) on privileged functionality, so exploitation depends on reaching a Policy Manager endpoint/action that should be role-restricted but is not. Limiting factors: a pre-existing low-privilege credential is mandatory, the Policy Manager must be network-reachable by that account, and affected deployments are those running versions prior to the fixed build (verify 5.34.00.16 vs the EUVD-listed 5.36.00.16). No user interaction is required (UI:N) and attack complexity is low (AC:L), so once a foothold exists the barrier is minimal.

Signals are largely consistent and point to a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, yielding full C/I/A impact (8.8/High) - attractive for an already-authenticated low-privilege user to escalate. However, the real-world exploitation signals temper this: EPSS is only 0.16% (5th percentile), there is no CISA KEV listing, and CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. The 'partial' SSVC technical-impact rating mildly conflicts with the CVSS full-impact (C:H/I:H/A:H) scoring and suggests the escalation may not grant total system control. Net assessment: this is a legitimate patch-worthy privilege-escalation issue in an enterprise support gateway, but the absence of known exploitation, low EPSS, and non-automatable, non-public-exploit status place it below internet-facing unauthenticated criticals in triage. The PR:L requirement (a pre-existing low-privileged foothold) is the key factor that lowers practical risk versus the raw 8.8 score.

A low-privileged user who already has authenticated remote access to the SCG Policy Manager sends requests to a function or endpoint that fails to enforce authorization checks (CWE-862 Missing Authorization), performing actions reserved for higher-privileged roles and thereby elevating their privileges. No public exploit code or active exploitation has been identified, and the low attack complexity means a valid low-privilege account is the main prerequisite.