Secure Connect Gateway EUVD-2026-95569

Exploitation requires the attacker to already possess a low-privileged authenticated foothold on the Dell Secure Connect Gateway (SCG) Policy Manager reachable over the network (CVSS PR:L, AV:N, UI:N), running a version prior to the fixed release (stated as 5.34.00.16 in the description, 5.36.00.16 in EUVD - reconcile before action). No victim user interaction is needed and attack complexity is low. The principal limiting factor is the PR:L authentication requirement: a fully anonymous external attacker cannot exploit this directly, so realistic risk concentrates where the Policy Manager is exposed to untrusted networks or where low-privilege credentials are easy to obtain. The specific untrusted functionality (CWE-829) path is not detailed in the available data, so the exact triggering feature could not be pinned down from the description.

Signals are mostly consistent and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw that an already-authenticated low-privileged attacker can exploit for full confidentiality, integrity and availability impact - consistent with CWE-829 (Inclusion of Functionality from an Untrusted Control Sphere) and the stated outcomes of privilege elevation, filesystem access and remote code execution. Counterbalancing this, exploitation-likelihood signals are low: EPSS is 0.33% (24th percentile), CISA SSVC records Exploitation=none and Automatable=no (though Technical Impact=total agrees with the high CVSS impacts), the CVE is not in CISA KEV, and no public PoC is identified. The one notable discrepancy is the required-versions data: the NVD/CVE description says 'prior to 5.34.00.16' while the EUVD fixed-version field says '<5.36.00.16 or later' - these do not match and must be verified against the Dell DSA-2026-385 advisory before remediation. Net: a genuine high-severity, patch-worthy vulnerability, but current intelligence indicates no active or automatable exploitation, so it is a prompt-patch priority rather than an emergency drop-everything item - weighted up for environments where the Policy Manager is internet-exposed or holds many low-privileged accounts.

An attacker who already holds a low-privileged account on (or network access to) the Dell SCG Policy Manager leverages the untrusted-functionality-inclusion flaw to load or invoke attacker-controlled functionality, escalating to high privileges and reading or writing the filesystem. From there they achieve remote code execution on the Policy Manager host, pivoting into the Dell support/telemetry management plane. No public exploit code is identified at time of analysis, so this currently requires attacker-developed tooling.