EUVD-2026-95570
GHSA-4wmw-p7m3-h442
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain man-in-the-middle network position
-
DeliveryPresent forged/invalid certificate to victim
-
ExploitCertificate validation bypass accepts rogue endpoint
-
ExecutionInject malicious response payload
-
ImpactTrigger RCE/info disclosure/DoS on Policy Manager
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V12 - Secure Communication Certificate validation
|
| Exploitation Conditions | Exploitation requires the attacker to occupy a man-in-the-middle position on the network path to the Dell SCG Policy Manager and relies on the product's failure to properly validate X.509 certificates (CWE-295), allowing a forged or untrusted certificate to be accepted. User/client interaction is required (UI:R) - a victim must initiate or complete the affected TLS connection - which meaningfully limits opportunistic exploitation. No valid credentials are needed (PR:N, unauthenticated). Practical risk is constrained by the need for network path interception and the likelihood that the Policy Manager is deployed on trusted management segments rather than exposed to untrusted networks. |
| Impact | Vendor CVSS is 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, claiming total CIA impact (DoS, information disclosure, and remote execution). However, multiple real-world signals pull the priority down. EPSS is only 0.18% (7th percentile), indicating very low near-term exploitation probability, and CISA SSVC lists Exploitation: none and Automatable: no, so there is no evidence of active or scalable exploitation. The flaw is KEV=NO and no public exploit was identified. There is tension between the CVSS metrics and the vulnerability class: CWE-295 (Improper Certificate Validation) typically requires an attacker to be positioned on the network path (MITM) and to coerce or wait for a client connection (consistent with UI:R), which realistically implies higher attack complexity than the AC:L assigned by the vendor - verify positioning requirements with Dell. SSVC Technical Impact: total aligns with the C:H/I:H/A:H claim. Net: this is a genuinely serious flaw in a security-relevant appliance and should be patched, but the low EPSS, no-KEV, no-POC, and non-automatable SSVC signals mark it as a patch-on-normal-cycle item rather than an emergency, absent exposure of the Policy Manager to untrusted networks. |
| Exploit ScenarioDerived | An attacker positioned on the network path between a client and the Dell SCG Policy Manager exploits the improper certificate validation to impersonate a trusted endpoint, inducing the victim to establish a connection (UI:R). Having defeated TLS trust, the attacker injects malicious responses that can crash the service, disclose sensitive data in transit, or achieve remote code execution. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 14, 2026
Improper X.509 certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets an unauthenticated attacker who has already attained a man-in-the-middle position on the network path to the appliance substitute a forged or untrusted certificate and hijack the affected TLS session, with the potential to disrupt service, expose data, and execute code in the context of the connection. Exploitation is not opportunistic: per the independent assessment the vector is AV:N/AC:H/PR:N/UI:R, so an attacker must both intercept the network path and induce a victim or client to initiate or complete the affected TLS handshake, which meaningfully limits exposure where the Policy Manager sits on a trusted management segment. Risk is currently low-to-moderate in practice - EPSS is 0.18% (7th percentile), no public exploit code has been identified at time of analysis, and CISA SSVC records Exploitation: none - although the vendor CVSS of 8.8 (High) reflects total confidentiality, integrity, and availability impact if the MITM precondition is met.
Earlier versions of this analysis (1)
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager before 5.34.00.16 allows a network-positioned attacker to present forged certificates and thereby intercept or alter connections, with potential outcomes including denial of service, information disclosure, and remote code execution. The flaw is unauthenticated from the attacker's perspective (PR:N) but requires a man-in-the-middle position and a victim-initiated connection (AC:H/UI:R), and no public exploit identified at time of analysis.
RemediationAI
Patch status: Patch available per vendor advisory - Dell has published a fix, but the CVE description (5.34.00.16) and the EUVD record (5.36.00.16 or later) cite different fixed builds, so confirm the exact target version in Dell DSA-2026-385 before upgrading and apply the latest Policy Manager release rather than the minimum cited number. Until the upgrade is complete, the dominant compensating control is to eliminate the man-in-the-middle precondition: place the Policy Manager on an isolated, trusted management VLAN with no routing to untrusted networks, restrict management UI and API reachability by firewall ACL, and enforce strict egress filtering so the appliance cannot be coerced into TLS sessions with attacker-controlled endpoints. Where the connection path cannot be trusted, terminate or broker the appliance's TLS traffic through an inspected proxy that performs its own certificate validation, accepting the trade-off that inline inspection may break functionality if the product pins or mutually authenticates certificates. Because user or client interaction is required (UI:R), discouraging or blocking interactive access to management endpoints from shared or untrusted clients reduces the attack surface. Removing unnecessary trust anchors and pre-provisioning the expected peer certificates or fingerprints narrows the set of certificates the appliance will accept, with the side effect that legitimate certificate rotation will require an explicit update step. Continue to monitor Dell's advisory page for revised fixed versions and downgrade guidance.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-295, Improper Certificate Validation: the SCG Policy Manager does not correctly verify the trust chain, validity, or identity binding of X.509 certificates presented during TLS negotiation, so a certificate that should be rejected is accepted instead. Once the trust check is bypassed, an adversary in a man-in-the-middle position can terminate the TLS connection, decrypt or alter traffic in transit, and interact with the peer as though it were the legitimate endpoint; this is consistent with the reported impact set of denial of service, information disclosure, and remote execution. Dell Secure Connect Gateway is the remote-connectivity and monitoring layer Dell ships to collect telemetry and manage supported Dell infrastructure, and the Policy Manager component is a management/control surface rather than an internet-facing service, which is why the independent assessment raises the attack complexity to AC:H - path interception is the gating condition, not credential theft. The affected product is identified in the CPE as cpe:2.3:a:dell:secure_connect_gateway_(scg)_policy_manager:*:*:*:*:*:*:*:* (all versions of the product before the fixed release), and because the flaw lives in certificate validation it is version-bound to the shipped TLS stack rather than to any single protocol configuration.
Know when Secure Connect Gateway Scg Policy Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Improper certificate validation requires a MITM position and a victim-initiated connection, so AC:H and UI:R; no authentication needed (PR:N) and the class permits full CIA compromise.
Primary rating from Vendor (dell).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service, Information disclosure, and Remote execution.
Executive ViewAI
Dell Secure Connect Gateway (SCG) Policy Manager contains a high-severity certificate-validation flaw that could allow an attacker positioned on the network path to hijack TLS sessions, potentially disrupting service, exposing data, or executing code in the connection context. Although no public exploit or known active exploitation has been identified, the appliance's role in management infrastructure means a successful compromise could affect downstream systems and operational visibility. Leadership should prioritize patching to preserve trust in the gateway's TLS protections and limit management-plane exposure.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Weak authentication throttling in Dell Secure Connect Gateway (SCG) Policy Manager allows unauthenticated remote attacke
Privilege escalation, filesystem access, and remote code execution in Dell Secure Connect Gateway (SCG) Policy Manager a
Authorization bypass in Dell Secure Connect Gateway (SCG) Policy Manager lets an authenticated, low-privileged user tamp
Privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager allows an authenticated, network-reachable low-
Elevation of privilege in Dell Secure Connect Gateway (SCG) Policy Manager lets an attacker who already holds a valid lo
Improper TLS certificate validation in Dell Secure Connect Gateway (SCG) Policy Manager lets a man-in-the-middle who alr
Server-side request forgery in Dell Secure Connect Gateway (SCG) Policy Manager allows a remote attacker who already hol
Protection mechanism bypass in Dell Secure Connect Gateway (SCG) Policy Manager (versions below the vendor-fixed release
Cross-site request forgery in Dell Secure Connect Gateway (SCG) Policy Manager prior to the vendor-fixed build allows a
Local privilege escalation in Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 lets a low-p
Unauthenticated remote attackers can reach a critical function in Dell Secure Connect Gateway (SCG) Policy Manager witho
Information exposure in Dell Secure Connect Gateway (SCG) Policy Manager affects all deployments running versions prior
Exploit-DB