Secure Connect Gateway EUVD-2026-95579

Requires the attacker to already hold a valid low-privileged, authenticated account on the Dell Secure Connect Gateway (SCG) Policy Manager (PR:L) with network reachability to its interface; exploitation then involves tampering with a user-controlled key/identifier to bypass authorization (CWE-639) and reach resources or actions reserved for higher-privileged users. Limiting factors: valid credentials are mandatory (not exploitable by fully unauthenticated outsiders), and only SCG Policy Manager builds below the fixed version are affected. No special non-default configuration or user interaction is required (UI:N).

Signals are largely consistent and point to a genuine but not emergency-grade priority. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N) indicates a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with high confidentiality, integrity and availability impact - a credible privilege-escalation path once an attacker holds any low-level account. However, exploitation-likelihood signals are decidedly cool: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and CISA's SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. Notably, the vendor-assigned CVSS 'High' severity and 'partial' SSVC technical impact are in mild tension, and the SSVC 'partial' rating sits below the full C:H/I:H/A:H of the CVSS vector - this likely reflects that the authorization bypass (CWE-639) yields escalation within the application rather than total system compromise. Because PR:L requires the attacker to already be authenticated and the flaw is not automatable, real-world risk is moderate and insider/post-foothold in nature rather than mass-exploitable. Net: patch promptly as a meaningful privilege-escalation issue, but it is not a drop-everything internet-worm scenario.

A low-privileged but authenticated user of the Dell Secure Connect Gateway Policy Manager manipulates a user-controlled key or object identifier in a request to reference resources or actions belonging to higher-privileged accounts, bypassing authorization checks and elevating their privileges. Because AV:N/AC:L/UI:N, this is achievable remotely over the network in a single low-complexity request with no victim interaction. No public proof-of-concept exploit code was identified in the provided data.