CVE-2026-73595: Dell SCG Policy Manager RCE Vulnerability

CVE-2026-73595 Overview

CVE-2026-73595 affects Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 and versions prior to 5.36. The flaw is a Download of Code Without Integrity Check weakness [CWE-494]. An unauthenticated attacker with remote network access could exploit the vulnerability to achieve code execution, information disclosure, information tampering, and protection mechanism bypass. Successful exploitation requires user interaction and involves high attack complexity, which limits practical exploitation but does not eliminate the risk to affected deployments.

Critical Impact

An unauthenticated remote attacker could deliver unverified code to the Policy Manager, leading to code execution, data exposure, tampering, and bypass of protection mechanisms.

Affected Products

• Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16
• Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.36
• Deployments relying on SCG for remote support telemetry and policy enforcement

Discovery Timeline

• 2026-09-29 - CVE-2026-73595 published to the National Vulnerability Database
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-73595

Vulnerability Analysis

The vulnerability resides in the update or content-download workflow of the Dell SCG Policy Manager. The component retrieves executable code or configuration payloads without verifying integrity through cryptographic signatures or checksums. An attacker positioned to influence the download path can substitute attacker-controlled code that the Policy Manager subsequently trusts and executes. The scope change reflected in the CVSS metrics indicates that compromise of the Policy Manager can affect resources beyond its own security authority, including systems that rely on its policy decisions.

Root Cause

The root cause is missing integrity validation on downloaded code, categorized as [CWE-494] Download of Code Without Integrity Check. The Policy Manager does not enforce signature verification or hash validation before loading or executing retrieved payloads, allowing tampered content to be processed as trusted.

Attack Vector

Exploitation requires network access and user interaction, and it carries high attack complexity. An attacker must intercept, redirect, or otherwise influence the download channel used by SCG Policy Manager. Once a malicious payload is delivered and accepted, the attacker can execute code within the Policy Manager context, alter policy data, or bypass protection controls that depend on the integrity of the downloaded content.

No verified public proof-of-concept code is available. See the Dell Security Update DSA-2026-385 for vendor technical details.

Detection Methods for CVE-2026-73595

Indicators of Compromise

• Unexpected outbound connections from SCG Policy Manager hosts to domains outside Dell update infrastructure
• New or modified executables, JAR files, or configuration bundles in Policy Manager installation directories without a corresponding change window
• Policy Manager process spawning unusual child processes such as shells, script interpreters, or network utilities
• Authentication or policy events reflecting configuration changes that do not map to administrator activity

Detection Strategies

• Baseline the normal update sources and file hashes for SCG Policy Manager binaries and alert on deviation
• Inspect TLS termination logs and proxy telemetry for redirection of Dell update endpoints
• Correlate Policy Manager service restarts with file-write events on installation paths
• Apply behavioral endpoint detection to flag unsigned or newly written code executed by the Policy Manager service account

Monitoring Recommendations

• Centralize SCG Policy Manager logs, host process telemetry, and network flow data in a SIEM for cross-source correlation
• Alert on modifications to update configuration files, trust stores, or scheduled update tasks on Policy Manager hosts
• Monitor for DNS resolutions and HTTP requests to non-approved update mirrors from Policy Manager systems

How to Mitigate CVE-2026-73595

Immediate Actions Required

• Upgrade Dell SCG Policy Manager to version 5.34.00.16 or 5.36 or later as directed by Dell
• Restrict outbound network access from Policy Manager hosts to Dell-approved update endpoints only
• Require administrator confirmation and change control for all Policy Manager update operations until patched
• Review Policy Manager hosts for unauthorized binaries, scheduled tasks, or configuration drift

Patch Information

Dell has released fixed versions addressing this vulnerability. Refer to the Dell Security Update DSA-2026-385 advisory for the complete list of remediated versions and upgrade instructions. Apply the vendor-supplied update to versions 5.34.00.16 or 5.36 or later.

Workarounds

• Place Policy Manager hosts behind an egress proxy that enforces allowlisting of legitimate Dell update domains
• Segment SCG Policy Manager from general user networks to reduce exposure to attackers capable of influencing downloads
• Disable or gate automatic update mechanisms and require manual, hash-verified installation of update packages until the patch is applied

# Configuration example: restrict egress to Dell update endpoints
# Replace <dell-update-fqdn> with the approved Dell update hostnames from DSA-2026-385
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -d <dell-update-fqdn> -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --dport 443 -j DROP