Secure Connect Gateway EUVD-2026-95583

Exploitation requires an authenticated low-privileged account on the Dell Secure Connect Gateway (SCG) Policy Manager that is network-reachable (PR:L, AV:N, UI:N). The specific prerequisite is attacker ability to supply or manipulate the user-controlled key (an object/resource identifier) that the application trusts for authorization decisions (CWE-639). Limiting factors: the attacker must already possess valid low-privilege credentials or an existing session - this is not an unauthenticated flaw - and only instances running versions below the patched build (reported variously as 5.34.00.16 or 5.36.00.16) are affected. No user interaction by a victim and no special non-default configuration are indicated in the available data.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) indicates a remotely reachable flaw requiring only low privileges, no user interaction, and low complexity, with total compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) - consistent with CWE-639 Authorization Bypass Through User-Controlled Key (an IDOR-style flaw) enabling privilege escalation. The CVSS base score of 8.8 (High) and SSVC Technical Impact of 'total' agree on severe consequences. However, the exploitation-likelihood signals all point low: EPSS is 0.18% (6th percentile), SSVC Exploitation is 'none', SSVC Automatable is 'no', and there is no CISA KEV listing and no public exploit identified. The low EPSS combined with 'total' technical impact is a classic high-impact/low-current-exploitation profile - the damage if exploited is severe, but there is no evidence of active or imminent mass exploitation. A key limiting factor is PR:L: an attacker must already hold a low-privileged authenticated foothold on the Policy Manager, which narrows the realistic attacker set to those who can obtain valid low-level credentials or an existing account. Note a data conflict to verify with the vendor: the NVD/description fixed version is 'prior to 5.34.00.16' while the EUVD advisory states 'prior to 5.36.00.16' - confirm the exact patched build against the Dell DSA-2026-385 advisory before remediation.

A low-privileged authenticated user of the Dell SCG Policy Manager manipulates a user-controlled key (e.g., an object or resource identifier in an API/web request) to reference resources or actions belonging to a higher-privileged account. Because authorization is keyed off attacker-supplied input rather than the session's actual privileges, the request succeeds and the attacker escalates to full control of the Policy Manager. No public exploit code has been identified at the time of analysis.