Description
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges, Protection mechanism bypass, and Unauthorized access.
Published: 2026-09-23
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Elevation of Privileges
Action: Patch Now
AI Analysis

Impact

Insufficient session expiration in Dell Secure Connect Gateway (SCG) Policy Manager allows an actor with low privileges and adjacent network access to prolong a session beyond its intended lifetime. This flaw is described by CWE-613 and can be leveraged to bypass protection mechanisms, elevate privileges, and gain unauthorized access to the system.

Affected Systems

Dell Secure Connect Gateway Policy Manager versions earlier than 5.34.00.16 are affected.

Risk and Exploitability

The CVSS score of 6.4 indicates moderate—not‑critical—that the vulnerability can have significant impact if exploited. EPSS is not available, and the issue is not listed in the CISA KEV catalog, suggesting no widely publicized exploitation yet. The likely attack vector is a local network actor who can connect to the SCG components; once the session expiration is insufficient, privileges may be escalated without needing elevated credentials.

Generated by OpenCVE AI on September 23, 2026 at 15:49 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Dell DSA‑2026‑385 security update to upgrade SCG Policy Manager to version 5.34.00.16 or later.
  • If an upgrade is infeasible, isolate the SCG components from the rest of the network, disabling unused management interfaces and restricting administrative traffic to trusted hosts only.
  • Implement additional session‑timeout controls and enforce strict access‑control policies to reduce the window of opportunity for privilege escalation.

Generated by OpenCVE AI on September 23, 2026 at 15:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 13:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell policy Manager For Secure Connect Gateway
CPEs cpe:2.3:a:dell:policy_manager_for_secure_connect_gateway:*:*:*:*:*:*:*:*
Vendors & Products Dell policy Manager For Secure Connect Gateway

Thu, 24 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Dell
Dell secure Connect Gateway Policy Manager
Vendors & Products Dell
Dell secure Connect Gateway Policy Manager

Wed, 23 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 16:15:00 +0000

Type Values Removed Values Added
Title Insufficient Session Expiration in Dell Secure Connect Gateway Policy Manager Allows Privilege Escalation

Wed, 23 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Description Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Insufficient Session Expiration vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Elevation of privileges, Protection mechanism bypass, and Unauthorized access.
Weaknesses CWE-613
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L'}

Subscriptions

Dell Policy Manager For Secure Connect Gateway Secure Connect Gateway Policy Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: dell

Published:

Updated: 2026-09-24T03:55:29.845Z

Reserved: 2026-08-13T11:04:26.933Z

Link: CVE-2026-73586

cve-icon Vulnrichment

Updated: 2026-09-23T18:16:26.169Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-23T15:17:17.583

Modified: 2026-09-25T13:35:41.337

Link: CVE-2026-73586

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T09:11:01Z

Weaknesses
  • CWE-613

    Insufficient Session Expiration