Secure Connect Gateway EUVD-2026-95584

Exploitation requires the attacker to already hold high-privilege authenticated access to the Dell Secure Connect Gateway (SCG) Policy Manager management interface (CVSS PR:H) - this is the primary limiting factor and means it is not remotely exploitable by anonymous users. The vulnerable component is the SCG Policy Manager in versions prior to 5.34.00.16; upgrading to 5.34.00.16 or later remediates it. The flaw lets the privileged attacker coerce the server into issuing attacker-directed requests (SSRF), with scope change (S:C) indicating the server can reach backend/internal resources beyond its own security boundary, resulting in confidentiality impact only (C:H, I:N, A:N). No user interaction is required (UI:N). The main constraints limiting real-world risk are the high privilege requirement and the absence of any confirmed exploitation or public exploit in the provided intelligence.

This is a moderate-severity, low-urgency issue rather than a top priority. The vendor CVSS of 5.8 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N) is network-reachable but gated behind PR:H (high privileges), meaning the attacker must already be an authenticated, highly privileged user of the SCG Policy Manager before anything else applies - a significant barrier that sharply reduces real-world exploitability. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there is no signal of active or probable exploitation; per the input this is 'no public exploit identified at time of analysis.' The signals are internally consistent (no CVSS/description conflict): the description's 'high privileged attacker with remote access' aligns with AV:N and PR:H, and the SSRF+information-disclosure impact aligns with C:H/I:N/A:N and the changed scope (S:C) reflecting reach into backend systems. Missing data to note explicitly: EPSS probability is absent (cannot quantify likelihood), KEV status is absent (no confirmed exploitation), and POC availability is unknown. Bottom line: a genuine but privilege-dependent SSRF that most organizations can patch on a normal cycle rather than treat as an emergency.

An attacker who has already obtained high-privilege authenticated access to the Dell SCG Policy Manager web interface submits a crafted request that causes the server to make attacker-controlled outbound requests. Because the scope is changed (S:C), the server can be coerced into reaching internal/backend systems it can access, returning sensitive data to the attacker (information disclosure). No public exploit code was identified in the provided data, and exploitation requires pre-existing privileged access.